@runuai/host 0.9.148 → 0.9.149

package/scripts/agent/task-up.sh

@@ -37,6 +37,10 @@ setup_err_trap
 # Pinned constants (all clusters must agree — see ADR-022).
 STANDARD_IMAGE="uai-standard:dev"
 ASDF_VOLUME="uai-asdf-data"
+# Keep in sync with lib/standard-image.ts. Apple tasks execute the env
+# forwarder from the shared volume's read-only lower mount, never from the
+# node-writable overlay at /opt/asdf-data.
+STANDARD_DEFAULT_NODE_VERSION="22.11.0"
 TASK_NPM_PREFIX="/home/node/.local/share/uai-npm"
 TASK_NPM_CACHE="/home/node/.cache/uai-npm"
 # Host-proved shims and system controls always win. A task-global package with
@@ -73,17 +77,42 @@ validate_task_runtime_selection
 APPLE_TASK_MEMORY="${UAI_APPLE_TASK_MEMORY:-8192M}"
 APPLE_TASK_CPUS="${UAI_APPLE_TASK_CPUS:-4}"
 
-# Project-defined environment values arrive as one JSON object on stdin. They
-# are deliberately NOT part of this host process environment: names such as
-# BASH_ENV, PATH, GIT_CONFIG_*, and UAI_* must not influence task setup or the
-# credentialed host-side fetch. Values stay in shell memory until Compose reads
-# an override document from stdin; they are never written to disk.
-project_env_json=$(cat)
-[ -n "$project_env_json" ] || project_env_json='{}'
-if ! printf '%s' "$project_env_json" | jq -e 'type == "object"' >/dev/null 2>&1; then
-  emit_err "BAD_ARGS" "task environment payload must be a JSON object" "read task environment"
+# ADR-153 makes the task's project-env delivery mode explicit. A loader task's
+# stdin is exactly one base64-encoded task-generation forwarder secret; it is
+# never put in argv, the environment, or a file. A legacy baked task retains
+# the old JSON-object stdin contract until its container is recreated.
+UAI_PROJECT_ENV_MODE=${UAI_PROJECT_ENV_MODE:-baked}
+case "$UAI_PROJECT_ENV_MODE" in
+  baked | loader) ;;
+  *)
+    emit_err "BAD_ARGS" \
+      "task project env mode must be baked or loader" \
+      "read task environment mode"
+    ;;
+esac
+
+task_stdin_payload=$(cat)
+task_gateway_secret_b64=""
+if [ "$UAI_PROJECT_ENV_MODE" = "loader" ]; then
+  task_gateway_secret_b64=$task_stdin_payload
+  project_env_json='{}'
+  # A 32-byte value has one canonical standard-base64 shape. Validate that
+  # shape here without decoding it into a shell variable (which cannot carry
+  # NUL); the only decode happens later, directly into the forwarder's stdin.
+  if [[ ! "$task_gateway_secret_b64" =~ ^[A-Za-z0-9+/]{43}=$ ]]; then
+    emit_err "BAD_ARGS" \
+      "loader task gateway secret must decode to exactly 32 bytes" \
+      "read task gateway secret"
+  fi
+else
+  project_env_json=$task_stdin_payload
+  [ -n "$project_env_json" ] || project_env_json='{}'
+  if ! printf '%s' "$project_env_json" | jq -e 'type == "object"' >/dev/null 2>&1; then
+    emit_err "BAD_ARGS" "task environment payload must be a JSON object" "read task environment"
+  fi
+  project_env_json=$(printf '%s' "$project_env_json" | jq -c '.')
 fi
-project_env_json=$(printf '%s' "$project_env_json" | jq -c '.')
+unset task_stdin_payload
 
 # -----------------------------------------------------------------------------
 # Paths (mirror host-agent/lib/env.ts).
@@ -724,6 +753,23 @@ git_host_control() (
     "$@"
 )
 
+# ADR-153 §4: record, once, the base a project's task worktree starts from, in
+# the host control tree the container never sees, before anything in the task
+# runs. The runner reads that commit's .env.schema from the host cache; a
+# resume keeps the first record and never consults the worktree, which the
+# task can rewrite. "oid <commit>" or "empty" (a branchless repository).
+record_env_schema_base() {
+  local project_id="$1" base="$2" dir="$task_uai_dir/env-schemas" tmp
+  [ -e "$dir/$project_id.base" ] && return 0
+  mkdir -p "$dir" || return 1
+  chmod 700 "$dir" || return 1
+  tmp=$(mktemp "$dir/.base.XXXXXX") || return 1
+  if ! printf '%s\n' "$base" > "$tmp" || ! mv -f "$tmp" "$dir/$project_id.base"; then
+    rm -f "$tmp"
+    return 1
+  fi
+}
+
 assert_bare_repo_tree_safe() {
   local repo="$1" code="$2" label="$3" bad_entry=""
   if [ -L "$repo" ] || [ ! -d "$repo" ]; then
@@ -1268,6 +1314,14 @@ while IFS= read -r project_obj; do
        "refs/remotes/origin/$project_default" >/dev/null 2>&1; then
     # Normal case: branch the task worktree off origin/<defaultBranch>.
     step "WORKTREE_FAILED" "git worktree add ($project_id)"
+    # The same commit the task repository just copied, read where the task
+    # never writes: the host cache, under this project's lock.
+    env_schema_oid=$(git_host_control -C "$mirror_dir" rev-parse --verify --quiet \
+      "refs/remotes/origin/$project_default^{commit}" 2>/dev/null || true)
+    if [ -n "$env_schema_oid" ]; then
+      record_env_schema_base "$project_id" "oid $env_schema_oid" \
+        || log "warning: could not record the .env.schema base for $project_id; its keys without a binding are withheld"
+    fi
     if ! git_host_control -C "$worktree_repo_dir" worktree add "$worktree_target" \
       -b "$task_branch" "origin/$project_default"; then
       emit_err "WORKTREE_FAILED" \
@@ -1282,6 +1336,15 @@ while IFS= read -r project_obj; do
     # repo. Leave a note (git-excluded so it isn't accidentally committed).
     step "WORKTREE_FAILED" "init empty workspace ($project_id)"
     log "warning: $repo_url has no '$project_default' branch (empty repo?); starting an empty workspace for $project_slug"
+    # Only a cache with no ref at all proves the repository empty. A missing
+    # default branch alone (say, a default that could not be resolved) is
+    # recorded as nothing, so its keys without a binding are withheld rather
+    # than read as declaring nothing.
+    if env_schema_refs=$(git_host_control -C "$mirror_dir" for-each-ref --count=1 2>/dev/null) \
+       && [ -z "$env_schema_refs" ]; then
+      record_env_schema_base "$project_id" "empty" \
+        || log "warning: could not record the .env.schema base for $project_id; its keys without a binding are withheld"
+    fi
     rm -rf "$worktree_target"
     mkdir -p "$worktree_target"
     git_host_control -C "$worktree_target" init -q -b "$project_default" 2>/dev/null \
@@ -1390,12 +1453,29 @@ fi
 UAI_INIT_SOURCE="$STANDARD_CONTAINER_DIR/uai-init"
 RUNTIME_MATERIALIZER_SOURCE="$STANDARD_CONTAINER_DIR/uai-materialize-runtimes"
 COREPACK_VERSION_SOURCE="$STANDARD_CONTAINER_DIR/corepack-version"
+ENV_HOOK_SOURCE="$SCRIPT_DIR/env-hook.sh"
+UAI_ENV_EXEC_SOURCE="$SCRIPT_DIR/uai-env-exec.sh"
+TASK_FORWARDER_SOURCE="$STANDARD_CONTAINER_DIR/uai-task-forwarder.mjs"
 if [ -L "$UAI_INIT_SOURCE" ] || [ ! -f "$UAI_INIT_SOURCE" ] \
    || [ ! -x "$UAI_INIT_SOURCE" ]; then
   emit_err "CONTAINER_INIT_FAILED" \
     "Uai's packaged task initializer is missing or unsafe. Repair or update the host installation, then retry." \
     "resolve packaged container assets"
 fi
+if [ "$UAI_PROJECT_ENV_MODE" = "loader" ]; then
+  for loader_asset in \
+    "$ENV_HOOK_SOURCE" \
+    "$UAI_ENV_EXEC_SOURCE" \
+    "$TASK_FORWARDER_SOURCE"
+  do
+    if [ -L "$loader_asset" ] || [ ! -f "$loader_asset" ] \
+       || [ ! -r "$loader_asset" ]; then
+      emit_err "CONTAINER_INIT_FAILED" \
+        "Uai's packaged task env loader is missing or unsafe. Repair or update the host installation, then retry." \
+        "resolve packaged env loader assets"
+    fi
+  done
+fi
 if [ "$project_count" -gt 0 ]; then
   if [ -L "$RUNTIME_MATERIALIZER_SOURCE" ] \
      || [ ! -f "$RUNTIME_MATERIALIZER_SOURCE" ] \
@@ -1438,6 +1518,18 @@ if ! copy_task_asset "$UAI_INIT_SOURCE" uai-init 0755; then
     "stage task container assets"
 fi
 UAI_INIT_SOURCE="$task_assets_dir/uai-init"
+if [ "$UAI_PROJECT_ENV_MODE" = "loader" ]; then
+  if ! copy_task_asset "$ENV_HOOK_SOURCE" env-hook.sh 0555 \
+     || ! copy_task_asset "$UAI_ENV_EXEC_SOURCE" uai-env-exec 0555 \
+     || ! copy_task_asset "$TASK_FORWARDER_SOURCE" uai-task-forwarder.mjs 0444; then
+    emit_err "CONTAINER_INIT_FAILED" \
+      "Uai could not stage the task env loader into this task's control tree. Check disk space and permissions under the Uai data directory, then retry." \
+      "stage task env loader assets"
+  fi
+  ENV_HOOK_SOURCE="$task_assets_dir/env-hook.sh"
+  UAI_ENV_EXEC_SOURCE="$task_assets_dir/uai-env-exec"
+  TASK_FORWARDER_SOURCE="$task_assets_dir/uai-task-forwarder.mjs"
+fi
 if [ -f "$RUNTIME_MATERIALIZER_SOURCE" ]; then
   if ! copy_task_asset "$RUNTIME_MATERIALIZER_SOURCE" uai-materialize-runtimes 0755; then
     emit_err "CONTAINER_INIT_FAILED" \
@@ -1531,8 +1623,10 @@ is_reserved_task_env_name() {
     GIT_INDEX_FILE | GIT_EXEC_PATH | GIT_ASKPASS | SSH_ASKPASS | \
     GIT_SSH | GIT_SSH_COMMAND | HOME | XDG_CONFIG_HOME | XDG_DATA_HOME | \
     XDG_CACHE_HOME | \
-    PATH | LD_PRELOAD | LD_AUDIT | LD_LIBRARY_PATH | NODE_OPTIONS | \
+    PATH | SHELL | LD_PRELOAD | LD_AUDIT | LD_LIBRARY_PATH | NODE_OPTIONS | \
     NODE_PATH | SHELLOPTS | BASHOPTS | PS4 | BASH_ENV | ENV | \
+    __UAI_ENV_* | __CURSOR_SANDBOX_ENV_RESTORE | GROK_LOGIN_ENV | \
+    NODE_EXTRA_CA_CERTS | SSL_CERT_FILE | REQUESTS_CA_BUNDLE | \
     ASDF_* | COREPACK_* | \
     [Nn][Pp][Mm]_[Cc][Oo][Nn][Ff][Ii][Gg]_[Pp][Rr][Ee][Ff][Ii][Xx] | \
     [Nn][Pp][Mm]_[Cc][Oo][Nn][Ff][Ii][Gg]_[Cc][Aa][Cc][Hh][Ee] | \
@@ -1547,6 +1641,39 @@ is_reserved_task_env_name() {
   return 1
 }
 
+# Names that the loader owns are non-secret metadata. Mount the exact launch
+# set read-only so uai-init can remove even the empty clears inherited from a
+# derived image before it starts code-server. The editor daemon itself never
+# loads project env; each terminal shell fetches independently.
+managed_env_keys_file="$task_uai_dir/managed-env-keys"
+managed_env_keys_tmp=$(mktemp "$task_uai_dir/.managed-env-keys.XXXXXX")
+# macOS still ships Bash 3.2, which has indexed arrays but no associative
+# arrays. Names are validated before this delimiter set is consulted, so `|`
+# cannot collide with an env name.
+managed_env_seen='|'
+{
+  while IFS= read -r managed_name; do
+    [[ "$managed_name" =~ ^[A-Za-z_][A-Za-z0-9_]*$ ]] || continue
+    is_reserved_task_env_name "$managed_name" && continue
+    case "$managed_env_seen" in *"|$managed_name|"*) continue ;; esac
+    managed_env_seen="${managed_env_seen}${managed_name}|"
+    printf '%s\n' "$managed_name"
+  done < <(jq -r '.[]' <<<"$union_env_keys_json")
+  preview_env_raw=$(jq -r '.[0].preview_env // "{}"' <<<"$task_json")
+  while IFS= read -r managed_name; do
+    [[ "$managed_name" =~ ^[A-Za-z_][A-Za-z0-9_]*$ ]] || continue
+    if [ "$managed_name" != "UAI_EDITOR_THEME" ] \
+       && is_reserved_task_env_name "$managed_name"; then
+      continue
+    fi
+    case "$managed_env_seen" in *"|$managed_name|"*) continue ;; esac
+    managed_env_seen="${managed_env_seen}${managed_name}|"
+    printf '%s\n' "$managed_name"
+  done < <(jq -r 'keys[]?' <<<"$preview_env_raw")
+} > "$managed_env_keys_tmp"
+chmod 0444 "$managed_env_keys_tmp"
+mv -f "$managed_env_keys_tmp" "$managed_env_keys_file"
+
 # Write the compose file. No top-level name: (the -p flag sets the project),
 # no container_name:. Env values live host-side (ADR-015): we emit only
 # pass-through references `${KEY:-}`.
@@ -1605,8 +1732,18 @@ is_reserved_task_env_name() {
     fi
   done < <(jq -c '.[]' <<<"$projects_json")
   printf '      - "%s:/usr/local/bin/uai-init:ro"\n' "$UAI_INIT_SOURCE"
+  if [ "$UAI_PROJECT_ENV_MODE" = "loader" ]; then
+    printf '      - "%s:/usr/local/share/uai/env-hook.sh:ro"\n' \
+      "$ENV_HOOK_SOURCE"
+    printf '      - "%s:/usr/local/bin/uai-env-exec:ro"\n' \
+      "$UAI_ENV_EXEC_SOURCE"
+    printf '      - "%s:/usr/local/share/uai/uai-task-forwarder.mjs:ro"\n' \
+      "$TASK_FORWARDER_SOURCE"
+  fi
   printf '      - "%s:/run/uai/runtime-projects:ro"\n' \
     "$runtime_projects_file"
+  printf '      - "%s:/run/uai/managed-env-keys:ro"\n' \
+    "$managed_env_keys_file"
   # Task processes consume only the exact runtimes/package managers proved by
   # pre-start maintenance. `:ro` is explicit because Docker's omitted default
   # is read-write and a legacy Compose file must never look equivalent.
@@ -1683,6 +1820,9 @@ is_reserved_task_env_name() {
   printf '      npm_config_umask: "0002"\n'
   printf '      UAI_WORKSPACE: "/workspace"\n'
   printf '      UAI_RUNTIME_PROJECTS: "/run/uai/runtime-projects"\n'
+  printf '      UAI_ENV_MODE: "%s"\n' "$UAI_PROJECT_ENV_MODE"
+  printf '      UAI_ENV_HOOK: "0"\n'
+  printf '      SHELL: "/usr/bin/zsh"\n'
   printf '      LD_PRELOAD: ""\n'
   printf '      LD_AUDIT: ""\n'
   printf '      LD_LIBRARY_PATH: ""\n'
@@ -1737,10 +1877,10 @@ is_reserved_task_env_name() {
     is_reserved_task_env_name "$ekey" && continue
     printf '      %s: ""\n' "$ekey"
   done < <(jq -r '.[]' <<<"$union_env_keys_json")
-  # Cloud-computed literal env (ADR-025): a JSON object {VAR: value} on the
-  # task row. Non-secret, so written LITERALLY (unlike the ${KEY:-}
-  # pass-throughs above). Emitted last so it wins over any same-named declared
-  # key. Two producers, both cloud-side and both opaque here:
+  # Cloud-computed env (ADR-025): a JSON object {VAR: value} on the task row.
+  # A legacy baked task writes the literals as before. A loader task emits only
+  # empty clears (to defeat a derived image's ENV); the loopback endpoint is
+  # the sole source of the current values. Two producers, both cloud-side:
   #   - PUBLIC preview URLs under operator-chosen names (EXPO_PACKAGER_PROXY_URL
   #     and friends), one per preview port that set `urlEnv`;
   #   - UAI_EDITOR_THEME (ADR-091), the Editor pane's colour theme as a VS Code
@@ -1759,7 +1899,11 @@ is_reserved_task_env_name() {
        && is_reserved_task_env_name "$pe_key"; then
       continue
     fi
-    printf '      %s: "%s"\n' "$pe_key" "$pe_val"
+    if [ "$UAI_PROJECT_ENV_MODE" = "loader" ]; then
+      printf '      %s: ""\n' "$pe_key"
+    else
+      printf '      %s: "%s"\n' "$pe_key" "$pe_val"
+    fi
   done < <(jq -c 'to_entries[]?' <<<"$preview_env_raw")
   printf 'volumes:\n'
   printf '  %s:\n' "$ASDF_VOLUME"
@@ -2038,9 +2182,11 @@ step "COMPOSE_UP_FAILED" "start task container"
 # without a temporary env/YAML file and without exporting any value to host
 # commands.
 preview_env_raw=$(jq -r '.[0].preview_env // "{}"' <<<"$task_json")
-filtered_project_env=$(printf '%s' "$project_env_json" | jq -c \
-  --argjson declared "$union_env_keys_json" \
-  --argjson preview "$preview_env_raw" '
+filtered_project_env='{}'
+if [ "$UAI_PROJECT_ENV_MODE" = "baked" ]; then
+  filtered_project_env=$(printf '%s' "$project_env_json" | jq -c \
+    --argjson declared "$union_env_keys_json" \
+    --argjson preview "$preview_env_raw" '
     .
     | with_entries(.key as $key | select($declared | index($key)))
     | with_entries(select(.key | test("^GIT_CONFIG($|_)") | not))
@@ -2049,6 +2195,7 @@ filtered_project_env=$(printf '%s' "$project_env_json" | jq -c \
         "i"
       ) | not))
     | with_entries(select(.key | test("^UAI_") | not))
+    | with_entries(select(.key | test("^__UAI_ENV_") | not))
     | del(
         .GH_TOKEN,
         .GITHUB_TOKEN,
@@ -2070,6 +2217,7 @@ filtered_project_env=$(printf '%s' "$project_env_json" | jq -c \
         .XDG_DATA_HOME,
         .XDG_CACHE_HOME,
         .PATH,
+        .SHELL,
         .LD_PRELOAD,
         .LD_AUDIT,
         .LD_LIBRARY_PATH,
@@ -2080,6 +2228,11 @@ filtered_project_env=$(printf '%s' "$project_env_json" | jq -c \
         .PS4,
         .BASH_ENV,
         .ENV,
+        .NODE_EXTRA_CA_CERTS,
+        .SSL_CERT_FILE,
+        .REQUESTS_CA_BUNDLE,
+        .__CURSOR_SANDBOX_ENV_RESTORE,
+        .GROK_LOGIN_ENV,
         .UAI_GIT_TRANSPORT,
         .CLAUDE_CODE_OAUTH_TOKEN,
         .ANTHROPIC_API_KEY,
@@ -2089,7 +2242,8 @@ filtered_project_env=$(printf '%s' "$project_env_json" | jq -c \
         .UAI_EDITOR_THEME
       )
     | delpaths($preview | keys | map([.]))
-  ')
+    ')
+fi
 compose_env_override=""
 if [ "$TASK_RUNTIME_MODE" = "docker" ]; then
   compose_env_override=$(printf '%s\n' "$filtered_project_env" | jq -c \
@@ -2187,6 +2341,9 @@ if [ "$TASK_RUNTIME_MODE" = "apple-container" ]; then
     printf 'npm_config_store_dir=%s\n' "$TASK_STORE_DIR"
     printf 'UAI_WORKSPACE=/workspace\n'
     printf 'UAI_RUNTIME_PROJECTS=/run/uai/runtime-projects\n'
+    printf 'UAI_ENV_MODE=%s\n' "$UAI_PROJECT_ENV_MODE"
+    printf 'UAI_ENV_HOOK=0\n'
+    printf 'SHELL=/usr/bin/zsh\n'
     printf 'LD_PRELOAD=\n'
     printf 'LD_AUDIT=\n'
     printf 'LD_LIBRARY_PATH=\n'
@@ -2200,8 +2357,16 @@ if [ "$TASK_RUNTIME_MODE" = "apple-container" ]; then
     printf 'ANTHROPIC_AUTH_TOKEN=%s\n' "${ANTHROPIC_AUTH_TOKEN:-}"
     printf 'XAI_API_KEY=%s\n' "${XAI_API_KEY:-}"
     printf 'PLAYWRIGHT_BROWSERS_PATH=/opt/pw-browsers\n'
-    printf '%s\n' "$filtered_project_env" \
-      | jq -r 'to_entries[] | "\(.key)=\(.value)"'
+    if [ "$UAI_PROJECT_ENV_MODE" = "loader" ]; then
+      while IFS= read -r ekey; do
+        [ -n "$ekey" ] || continue
+        is_reserved_task_env_name "$ekey" && continue
+        printf '%s=\n' "$ekey"
+      done < <(jq -r '.[]' <<<"$union_env_keys_json")
+    else
+      printf '%s\n' "$filtered_project_env" \
+        | jq -r 'to_entries[] | "\(.key)=\(.value)"'
+    fi
     while IFS= read -r pe_entry; do
       [ -n "$pe_entry" ] || continue
       pe_key=$(jq -r '.key' <<<"$pe_entry")
@@ -2211,7 +2376,11 @@ if [ "$TASK_RUNTIME_MODE" = "apple-container" ]; then
          && is_reserved_task_env_name "$pe_key"; then
         continue
       fi
-      printf '%s=%s\n' "$pe_key" "$pe_val"
+      if [ "$UAI_PROJECT_ENV_MODE" = "loader" ]; then
+        printf '%s=\n' "$pe_key"
+      else
+        printf '%s=%s\n' "$pe_key" "$pe_val"
+      fi
     done < <(jq -c 'to_entries[]?' <<<"$preview_env_raw")
   } > "$task_env_file"
   # The mount set matches the rendered Compose file's app service one-for-one
@@ -2239,6 +2408,7 @@ if [ "$TASK_RUNTIME_MODE" = "apple-container" ]; then
   apple_run_args+=(
     -v "$UAI_INIT_SOURCE:/usr/local/bin/uai-init:ro"
     -v "$runtime_projects_file:/run/uai/runtime-projects:ro"
+    -v "$managed_env_keys_file:/run/uai/managed-env-keys:ro"
     # ADR-108: the shared volume attaches READ-ONLY at a staging path and an
     # in-guest overlay presents it writable at /opt/asdf-data (upper = the
     # task's own layer). The shared volume is never written on the task path,
@@ -2254,6 +2424,13 @@ if [ "$TASK_RUNTIME_MODE" = "apple-container" ]; then
     # ownership-proven above; single-attach by runtime construction.
     -v "$TASK_STORE_VOLUME:$TASK_STORE_MOUNT"
   )
+  if [ "$UAI_PROJECT_ENV_MODE" = "loader" ]; then
+    apple_run_args+=(
+      -v "$ENV_HOOK_SOURCE:/usr/local/share/uai/env-hook.sh:ro"
+      -v "$UAI_ENV_EXEC_SOURCE:/usr/local/bin/uai-env-exec:ro"
+      -v "$TASK_FORWARDER_SOURCE:/usr/local/share/uai/uai-task-forwarder.mjs:ro"
+    )
+  fi
   if [ "$shared_files_mode" != "off" ]; then
     shared_suffix=""
     [ "$shared_files_mode" = "ro" ] && shared_suffix=":ro"
@@ -2269,13 +2446,15 @@ if [ "$TASK_RUNTIME_MODE" = "apple-container" ]; then
     fi
   fi
   apple_up_rc=0
-  # CAP_SYS_ADMIN: required for the ADR-108 in-guest overlay mount. The
-  # capability is confined by the VM boundary — the guest kernel is the
-  # task's own, so this grants nothing on the host.
+  # CAP_SYS_ADMIN: required for the ADR-108 in-guest overlay mount.
+  # CAP_NET_ADMIN: the ADR-153 secrets proxy's NAT chain, set by the runner's
+  # root execs (node has no sudo). Both are confined by the VM boundary: the
+  # guest kernel is the task's own, so they grant nothing on the host.
   "$CONTAINER_CLI" run -d --init \
     --name "$app_container" \
     -l "com.uai.task=$task_id" \
     --cap-add CAP_SYS_ADMIN \
+    --cap-add CAP_NET_ADMIN \
     --workdir /workspace \
     --memory "$APPLE_TASK_MEMORY" \
     --cpus "$APPLE_TASK_CPUS" \
@@ -2642,6 +2821,7 @@ managed_exec_env=(
   -e "LD_LIBRARY_PATH="
   -e "DYLD_INSERT_LIBRARIES="
   -e "DYLD_LIBRARY_PATH="
+  -e "UAI_ENV_HOOK=0"
   -e "BASH_ENV="
   -e "ENV="
   -e "GIT_CONFIG="
@@ -2709,9 +2889,16 @@ task_runtime_exec_env=(
   -e "NODE_OPTIONS="
   -e "NODE_PATH="
   -e "PS4="
+  -e "UAI_ENV_MODE=$UAI_PROJECT_ENV_MODE"
+  -e "UAI_ENV_HOOK=0"
+  -e "SHELL=/usr/bin/zsh"
   -e "BASH_ENV="
   -e "ENV="
 )
+editor_theme=$(jq -r '.UAI_EDITOR_THEME // empty' <<<"$preview_env_raw")
+if [ -n "$editor_theme" ]; then
+  task_runtime_exec_env+=( -e "UAI_EDITOR_THEME=$editor_theme" )
+fi
 # ADR-118 (apple only): every runtime-bearing exec — uai-init's installs
 # above all — must aim pnpm at the task's block volume, exactly like the
 # container env-file. Docker execs keep the historical environment.
@@ -2722,6 +2909,266 @@ if [ "$TASK_RUNTIME_MODE" = "apple-container" ]; then
   )
 fi
 
+# ADR-153 secrets proxy, first step: the CA bundle goes into the task's trust
+# store before anything else runs in it (the forwarder, uai-init, agents). The
+# runner wrote the bundle and its fixed install script to
+# UAI_SECRETS_PROXY_DIR (public material only); unset, the proxy is off and
+# nothing is installed. A failure leaves the task up without the proxy's
+# trust, and the runner withholds whatever would have needed it.
+secrets_proxy_trust=skipped
+secrets_proxy_pins=skipped
+secrets_proxy_dir=${UAI_SECRETS_PROXY_DIR:-}
+# Each outcome is also written back to the runner's directory the moment it
+# is known: uai-init's shells read the env before task-up returns, and the
+# runner gives the trust env only once the CA is really in place.
+secrets_proxy_report() {
+  [ -z "$secrets_proxy_dir" ] || printf '%s\n' "$2" > "$secrets_proxy_dir/$1" || true
+}
+if [ "$UAI_PROJECT_ENV_MODE" = "loader" ] && [ -n "$secrets_proxy_dir" ]; then
+  if [ -f "$secrets_proxy_dir/ca-install.sh" ] && [ -f "$secrets_proxy_dir/ca-bundle.pem" ] \
+     && crt exec -i -u root "${managed_exec_env[@]}" "$app_container" \
+          /bin/sh -c "$(cat "$secrets_proxy_dir/ca-install.sh")" \
+          < "$secrets_proxy_dir/ca-bundle.pem" >/dev/null; then
+    secrets_proxy_trust=installed
+  else
+    secrets_proxy_trust=failed
+    log "warning: could not install the secrets proxy CA in ${app_container}; its proxied keys stay withheld"
+  fi
+  secrets_proxy_report trust "$secrets_proxy_trust"
+fi
+
+# Loader tasks have two pieces of root-owned bootstrap inside the task:
+# immutable shell entry-point stubs, and a generation-authenticated loopback
+# forwarder. Maintenance commands above and below keep UAI_ENV_HOOK=0, so the
+# stubs cannot make runner-owned execs consume project configuration.
+if [ "$UAI_PROJECT_ENV_MODE" = "loader" ]; then
+  task_gateway_generation=${UAI_TASK_GATEWAY_GENERATION:-}
+  task_gateway_host=${UAI_TASK_GATEWAY_HOST:-}
+  task_gateway_port=${UAI_MCP_GATEWAY_PORT:-5877}
+  if [[ ! "$task_gateway_generation" =~ ^[A-Za-z0-9_-]{16,64}$ ]] \
+     || [[ ! "$task_gateway_host" =~ ^[A-Za-z0-9][A-Za-z0-9._:-]{0,254}$ ]] \
+     || [[ ! "$task_gateway_port" =~ ^[0-9]{1,5}$ ]] \
+     || [ "$task_gateway_port" -lt 1 ] \
+     || [ "$task_gateway_port" -gt 65535 ]; then
+    emit_err "CONTAINER_INIT_FAILED" \
+      "Uai could not establish this task's authenticated env channel. Retry the task after updating the host." \
+      "validate task env gateway identity"
+  fi
+
+  # A heredoc nested inside `$(cat ...)` containing `case` arms is parsed as
+  # shell syntax by Bash 3.2 (the system Bash on macOS) and makes every task-up
+  # fail before it runs. `read -d ''` assigns the same literal without a
+  # command-substitution parser context.
+  env_stub_installer=''
+  IFS= read -r -d '' env_stub_installer <<'UAI_ENV_STUB_INSTALLER' || true
+set -eu
+ensure_block() {
+  file=$1
+  line=$2
+  case "$file" in
+    /etc/zsh/zshenv | /etc/zsh/zshrc | /etc/bash.bashrc | /etc/profile.d/uai-env.sh) ;;
+    *) exit 1 ;;
+  esac
+  [ ! -L "$file" ] || exit 1
+  [ ! -e "$file" ] || [ -f "$file" ] || exit 1
+  directory=${file%/*}
+  [ -d "$directory" ] && [ ! -L "$directory" ] || exit 1
+  temporary=$(/usr/bin/mktemp "$directory/.uai-env-stub.XXXXXX")
+  trap '/bin/rm -f -- "$temporary"' EXIT
+  if [ -f "$file" ]; then
+    /usr/bin/awk '
+      $0 == "# >>> uai env loader >>>" { skipping = 1; next }
+      $0 == "# <<< uai env loader <<<" { skipping = 0; next }
+      !skipping { print }
+    ' "$file" > "$temporary"
+  fi
+  {
+    printf '%s\n' '# >>> uai env loader >>>'
+    printf '%s\n' "$line"
+    printf '%s\n' '# <<< uai env loader <<<'
+  } >> "$temporary"
+  /bin/chown root:root "$temporary"
+  /bin/chmod 0644 "$temporary"
+  /bin/mv -f -- "$temporary" "$file"
+  trap - EXIT
+}
+
+ensure_block /etc/zsh/zshenv '[ "${UAI_ENV_HOOK-0}" != 1 ] || { . /usr/local/share/uai/env-hook.sh; __uai_env_sync; }'
+ensure_block /etc/zsh/zshrc '[ "${UAI_ENV_HOOK-0}" != 1 ] || { type __uai_env_install_zsh_preexec >/dev/null 2>&1 || . /usr/local/share/uai/env-hook.sh; __uai_env_install_zsh_preexec; }'
+ensure_block /etc/bash.bashrc '[ "${UAI_ENV_HOOK-0}" != 1 ] || { . /usr/local/share/uai/env-hook.sh; __uai_env_sync; __uai_env_install_bash_preexec; }'
+ensure_block /etc/profile.d/uai-env.sh '[ "${UAI_ENV_HOOK-0}" != 1 ] || { . /usr/local/share/uai/env-hook.sh; if [ -z "${BASH_EXECUTION_STRING-}" ] || [ -z "${BASH_ENV-}" ]; then __uai_env_sync; fi; }'
+UAI_ENV_STUB_INSTALLER
+  if ! crt exec -u root "${managed_exec_env[@]}" "$app_container" \
+    /bin/bash -c "$env_stub_installer" >/dev/null; then
+    emit_err "CONTAINER_INIT_FAILED" \
+      "Uai could not install the root-owned task env shell hooks. Retry the task; project env remains withheld until this succeeds." \
+      "install task env shell hooks"
+  fi
+
+  task_forwarder_node=/usr/local/bin/node
+  if [ "$TASK_RUNTIME_MODE" = "apple-container" ]; then
+    task_forwarder_node="/run/uai/asdf-lower/installs/nodejs/$STANDARD_DEFAULT_NODE_VERSION/bin/node"
+  fi
+
+  task_forwarder_launcher=''
+  IFS= read -r -d '' task_forwarder_launcher <<'UAI_TASK_FORWARDER_LAUNCHER' || true
+set -eu
+task_id=$1
+generation=$2
+gateway_host=$3
+gateway_port=$4
+node_path=$5
+case "$gateway_port" in ''|*[!0-9]*) exit 1 ;; esac
+[ "$gateway_port" -ge 1 ] && [ "$gateway_port" -le 65535 ] || exit 1
+case "$node_path" in
+  /usr/local/bin/node) ;;
+  /run/uai/asdf-lower/installs/nodejs/22.11.0/bin/node)
+    [ ! -L "$node_path" ] && [ -f "$node_path" ] && [ -x "$node_path" ] \
+      || exit 1
+    ;;
+  *) exit 1 ;;
+esac
+state_dir=/run/uai/task-forwarder
+pid_file=$state_dir/pid
+ready_file=$state_dir/ready
+error_file=$state_dir/error.log
+umask 077
+[ ! -L "$state_dir" ] || exit 1
+[ ! -e "$state_dir" ] || [ -d "$state_dir" ] || exit 1
+/usr/bin/install -d -o root -g root -m 0700 "$state_dir"
+
+if [ -f "$pid_file" ] && [ ! -L "$pid_file" ]; then
+  old_pid=$(/bin/cat "$pid_file" 2>/dev/null || true)
+  case "$old_pid" in ''|*[!0-9]*) old_pid= ;; esac
+  if [ -n "$old_pid" ] && /bin/kill -0 "$old_pid" 2>/dev/null; then
+    old_uid=$(/usr/bin/awk '/^Uid:/ { print $2; exit }' "/proc/$old_pid/status" 2>/dev/null || true)
+    old_args=$(/usr/bin/tr '\000' '\n' < "/proc/$old_pid/cmdline" 2>/dev/null || true)
+    # /run survives a Docker stop/start. Its recorded pid may have been
+    # reused by uai-init or another innocent process; treat that record as
+    # stale and never signal a process unless both uid and argv prove it is
+    # this task's prior forwarder.
+    if [ "$old_uid" = 65532 ] \
+       && printf '%s\n' "$old_args" | /bin/grep -Fxq '/usr/local/share/uai/uai-task-forwarder.mjs' \
+       && printf '%s\n' "$old_args" | /bin/grep -Fxq "$task_id"; then
+      /bin/kill -TERM "$old_pid"
+      attempts=0
+      while /bin/kill -0 "$old_pid" 2>/dev/null && [ "$attempts" -lt 50 ]; do
+        /bin/sleep 0.1
+        attempts=$((attempts + 1))
+      done
+      if /bin/kill -0 "$old_pid" 2>/dev/null; then
+        /bin/kill -KILL "$old_pid"
+      fi
+    fi
+  fi
+fi
+/bin/rm -f -- "$pid_file" "$ready_file" "$error_file"
+
+# Non-interactive Bash otherwise gives an asynchronous command /dev/null as
+# stdin. Preserve the docker/container exec pipe explicitly, then close the
+# extra descriptor in both parent and child after fd 0 has been duplicated.
+exec 3<&0
+/usr/bin/env -i PATH=/usr/bin:/bin \
+  /usr/bin/setsid \
+  /usr/bin/setpriv \
+    --reuid=65532 \
+    --regid=65532 \
+    --clear-groups \
+    --bounding-set=-all \
+    --inh-caps=-all \
+    --ambient-caps=-all \
+    --no-new-privs \
+  "$node_path" \
+    /usr/local/share/uai/uai-task-forwarder.mjs \
+    --task-id "$task_id" \
+    --generation "$generation" \
+    --gateway-host "$gateway_host" \
+    --gateway-port "$gateway_port" \
+    --listen-port 5877 \
+  <&3 3<&- >"$ready_file" 2>"$error_file" &
+forwarder_pid=$!
+exec 3<&-
+printf '%s\n' "$forwarder_pid" > "$pid_file"
+
+attempts=0
+while [ "$attempts" -lt 50 ]; do
+  /bin/kill -0 "$forwarder_pid" 2>/dev/null || exit 1
+  if [ -f "$ready_file" ] \
+     && [ "$(/bin/cat "$ready_file" 2>/dev/null || true)" = READY ]; then
+    exit 0
+  fi
+  /bin/sleep 0.1
+  attempts=$((attempts + 1))
+done
+exit 1
+UAI_TASK_FORWARDER_LAUNCHER
+
+  base64_decode_args=()
+  if printf '' | base64 --decode >/dev/null 2>&1; then
+    base64_decode_args=(--decode)
+  elif printf '' | base64 -D >/dev/null 2>&1; then
+    base64_decode_args=(-D)
+  else
+    emit_err "CONTAINER_INIT_FAILED" \
+      "Uai could not decode the task env gateway credential on this host." \
+      "start task env forwarder"
+  fi
+  if ! printf '%s' "$task_gateway_secret_b64" \
+    | base64 "${base64_decode_args[@]}" \
+    | crt exec -i -u root "${managed_exec_env[@]}" "$app_container" \
+        /bin/bash -c "$task_forwarder_launcher" uai-task-forwarder \
+          "$task_id" "$task_gateway_generation" "$task_gateway_host" \
+          "$task_gateway_port" "$task_forwarder_node" \
+        >/dev/null; then
+    unset task_gateway_secret_b64
+    emit_err "CONTAINER_INIT_FAILED" \
+      "Uai could not start the authenticated task env forwarder. Retry the task; project env remains withheld until this succeeds." \
+      "start task env forwarder"
+  fi
+  unset task_gateway_secret_b64
+fi
+
+# ADR-153 secrets proxy, second step, now that the forwarder listens: the NAT
+# chain that sends the pin address's :443 to the forwarder, and the names
+# pinned to it. In the runner's order (routing-order): the chain before the
+# names when pinning, the names first when there is nothing to pin, so a
+# failure part-way never leaves a name pointing at a pin with nothing behind
+# it. The NAT step needs NET_ADMIN. A Docker container does not have it: the
+# step is the one privileged exec Uai makes, and only that process gets it.
+# An Apple task's VM was started with it, so there a root exec has it (and
+# the CLI has no --privileged).
+secrets_proxy_chain() {
+  if [ "$TASK_RUNTIME_MODE" = "apple-container" ]; then
+    set -- crt exec -u root
+  else
+    set -- docker exec --privileged -u root
+  fi
+  "$@" "${managed_exec_env[@]}" "$app_container" \
+    /bin/sh -c "$(cat "$secrets_proxy_dir/chain.sh")" >/dev/null \
+    || { log "warning: could not redirect the secrets proxy's names in ${app_container}"; return 1; }
+}
+secrets_proxy_names() {
+  crt exec -u root "${managed_exec_env[@]}" "$app_container" \
+    /bin/sh -c "$(cat "$secrets_proxy_dir/pins.sh")" >/dev/null \
+    || { log "warning: could not pin the secrets proxy's names in ${app_container}"; return 1; }
+}
+if [ "$secrets_proxy_trust" = "installed" ]; then
+  secrets_proxy_order=$(cat "$secrets_proxy_dir/routing-order" 2>/dev/null || true)
+  # A missing script would run as an empty, successful program.
+  if [ ! -f "$secrets_proxy_dir/pins.sh" ] || [ ! -f "$secrets_proxy_dir/chain.sh" ]; then
+    secrets_proxy_pins=failed
+    log "warning: the secrets proxy's pin scripts are missing for ${app_container}"
+  elif [ "$secrets_proxy_order" = "pin" ]; then
+    if secrets_proxy_chain && secrets_proxy_names; then secrets_proxy_pins=installed; else secrets_proxy_pins=failed; fi
+  elif [ "$secrets_proxy_order" = "unpin" ]; then
+    if secrets_proxy_names && secrets_proxy_chain; then secrets_proxy_pins=installed; else secrets_proxy_pins=failed; fi
+  else
+    secrets_proxy_pins=failed
+    log "warning: the secrets proxy's routing order is missing for ${app_container}"
+  fi
+  secrets_proxy_report pins "$secrets_proxy_pins"
+fi
+
 # OpenCode and code-server share ~/.local/share. OpenCode credentials are
 # copied as root below, so creating only its leaf with `mkdir -p` can leave the
 # shared parent root-owned (live 2026-08-04). Then node cannot create
@@ -3088,8 +3535,10 @@ emit_ok "$(jq -nc \
   --arg wp "$task_dir" \
   --arg csport "${code_server_port:-}" \
   --arg iw "${init_warning}" \
+  --arg spt "$secrets_proxy_trust" \
+  --arg spp "$secrets_proxy_pins" \
   --argjson previewPorts "$preview_ports_runtime_json" \
   '{composeProject:$cp,worktreePath:$wp}
    + (if $csport == "" then {} else {codeServerPort:($csport|tonumber)} end)
    + (if $iw == "" then {} else {initWarning:$iw} end)
-   + {previewPorts:$previewPorts}')"
+   + {previewPorts:$previewPorts, secretsProxyTrust:$spt, secretsProxyPins:$spp}')"