@runuai/host 0.9.149 → 0.9.151

package/lib/task-diff.ts

@@ -1,188 +1,91 @@
-import { existsSync } from "node:fs";
-import { spawnSync } from "node:child_process";
-import { join, posix } from "node:path";
-
 import type { TaskDiffInput, TaskDiffResult } from "../src/protocol";
-import { taskWorkspaceDir } from "./env";
 import {
+  countDiffLines,
+  jsonEscapedBytes,
   parseGitDiff,
-  runGitDiff,
-  runGitDiffInEnvironment,
-  runGitDiffUntracked,
-  runGitDiffUntrackedInEnvironment,
-  tryRunGitTextInEnvironment,
+  parseTaskDiffOutput,
+  taskDiffExecFailure,
+  taskDiffRequest,
+  TASK_DIFF_LINE_RESULT_BYTES,
+  TASK_DIFF_MAX_LINES,
+  TASK_DIFF_OUTPUT_BYTES,
+  TASK_DIFF_REPO_RESULT_BYTES,
+  TASK_DIFF_RESULT_BYTES,
 } from "./git-diff";
 import type { TaskEnvironmentHandle } from "./task-environment/types";
 
-// Cap how many untracked files we render as new-file patches. Each is a
-// separate in-environment Git execution, so a pathological untracked dir that
-// slips past .gitignore shouldn't turn the diff into thousands of execs.
-const MAX_UNTRACKED = 200;
-
 export type TaskDiffEnvironment = Pick<
   TaskEnvironmentHandle,
   "descriptor" | "exec"
 >;
 
+/**
+ * A task's diff, as one run of TASK_DIFF_SCRIPT in `environment`: the task's
+ * own runtime while it runs, a throwaway sandbox once it has stopped
+ * (task-diff-sandbox.ts). Never Git on the host: what a task configured in
+ * its repositories would run there as the runner's user (#cb3j0z).
+ *
+ * Each project's diff is the whole branch against its base, including
+ * uncommitted work: the merge-base (where the branch diverged from the
+ * remote's default branch) against the working tree, then each untracked
+ * file as a new-file patch. A project the run could not diff, or whose
+ * output the bound cut short, carries an error and no files: a partial
+ * patch is never taken for the whole. The whole diff renders at most
+ * TASK_DIFF_MAX_LINES lines, and its result serializes to at most
+ * TASK_DIFF_RESULT_BYTES (its patches JSON-escaped, and each line's
+ * object): a project that would pass what is left of either is an error,
+ * never parsed.
+ */
 export async function buildTaskDiff(
   input: TaskDiffInput,
-  environment: TaskDiffEnvironment | null = null,
+  environment: TaskDiffEnvironment,
 ): Promise<TaskDiffResult> {
-  if (
-    environment !== null &&
-    environment.descriptor.taskId !== input.taskId
-  ) {
+  if (environment.descriptor.taskId !== input.taskId) {
     throw new Error("task diff environment belongs to a different task");
   }
-  const workspaceRoot = taskWorkspaceDir(input.taskId);
-  const out: TaskDiffResult["repos"] = [];
-
-  for (const project of input.projects) {
-    const cwd = join(workspaceRoot, project.slug);
-    const environmentCwd = environment
-      ? posix.join(environment.descriptor.workspacePath, project.slug)
-      : null;
-    if (!environment && !existsSync(cwd)) continue;
+  if (input.projects.length === 0) return { repos: [] };
+  const slugs = input.projects.map((project) => project.slug);
+  const result = await environment.exec(taskDiffRequest(environment.descriptor.workspacePath, slugs));
+  const failure = taskDiffExecFailure(result);
+  const output = failure === null ? parseTaskDiffOutput(Buffer.from(result.stdout).toString("utf8")) : [];
+  const bounded = failure === null && result.stdout.length >= TASK_DIFF_OUTPUT_BYTES;
+  let linesLeft = TASK_DIFF_MAX_LINES;
+  // Each project's own entry, and the result's wrapper, come out first: the
+  // bound is on the whole result as it is sent.
+  let bytesLeft = Math.max(0, TASK_DIFF_RESULT_BYTES - 64 - input.projects.length * TASK_DIFF_REPO_RESULT_BYTES);
 
-    // Base branch is the remote's default branch (where task branches are cut
-    // from at task-up) — NOT the worktree's @{upstream}, which flips to
-    // origin/<task-branch> once the branch is pushed and would then hide all
-    // committed work (see resolveBase).
-    const base = await resolveBase(environment, cwd, environmentCwd);
-    // Diff the whole branch against base, including UNCOMMITTED work: compare
-    // the merge-base (where the branch diverged) to the WORKING TREE, not HEAD.
-    // The merge-base keeps base's own later commits from showing up reversed if
-    // it advanced; falling back to `base` itself if merge-base can't resolve.
-    const mergeBase =
-      (await runGitText(environment, cwd, environmentCwd, [
-        "merge-base",
-        base,
-        "HEAD",
-      ])) ?? base;
-    try {
-      // Tracked changes (committed + staged + unstaged): a commit-ish vs the
-      // working tree, so omitting `..HEAD` is the point.
-      let text = environment
-        ? await runGitDiffInEnvironment(
-            environment,
-            environmentCwd!,
-            mergeBase,
-          )
-        : await runGitDiff(cwd, mergeBase);
-
-      // Untracked files: `git diff <commit>` skips them, so list (honouring
-      // .gitignore) and append each as a /dev/null new-file patch.
-      const untracked = await listUntracked(
-        environment,
-        cwd,
-        environmentCwd,
-      );
-      for (const file of untracked) {
-        const patch = environment
-          ? await runGitDiffUntrackedInEnvironment(
-              environment,
-              environmentCwd!,
-              file,
-            )
-          : await runGitDiffUntracked(cwd, file);
-        if (patch.trim().length === 0) continue;
-        if (text.length > 0 && !text.endsWith("\n")) text += "\n";
-        text += patch;
-      }
-
-      out.push({
-        id: project.id,
-        name: project.slug,
-        mountPath: project.slug,
-        defaultBranch: stripOriginPrefix(base),
-        files: parseGitDiff(text),
-      });
-    } catch (err) {
-      out.push({
+  return {
+    repos: input.projects.map((project, index) => {
+      const found = output[index]?.slug === project.slug ? output[index] : undefined;
+      const entry = {
         id: project.id,
         name: project.slug,
         mountPath: project.slug,
-        defaultBranch: stripOriginPrefix(base),
-        files: [],
-        error: err instanceof Error ? err.message : String(err),
-      });
-    }
-  }
-
-  return { repos: out };
-}
-
-/**
- * Resolve the diff base for a worktree: the remote's default branch
- * (`origin/HEAD`, set at task-up via `remote set-head`), falling back to
- * `origin/main`. Runs Git in-environment when the task is live so credential
- * behavior stays inside the sandbox (see git-diff).
- *
- * We deliberately do NOT use the worktree's `@{upstream}`. At task-up it is
- * `origin/<defaultBranch>`, but once the task branch is pushed (e.g. a PR is
- * opened) its upstream flips to `origin/<task-branch>` — then
- * `merge-base(upstream, HEAD) ≈ HEAD`, so the diff would show only uncommitted
- * work instead of the whole branch.
- */
-async function resolveBase(
-  environment: TaskDiffEnvironment | null,
-  hostCwd: string,
-  environmentCwd: string | null,
-): Promise<string> {
-  const head = await runGitText(
-    environment,
-    hostCwd,
-    environmentCwd,
-    ["rev-parse", "--abbrev-ref", "origin/HEAD"],
-  );
-  if (head) return head;
-
-  return "origin/main";
+        defaultBranch: stripOriginPrefix(found?.base ?? "origin/main"),
+      };
+      if (found && found.error === undefined && found.tracked && found.untracked) {
+        const patches = found.patches ?? "";
+        const lines = countDiffLines(patches);
+        if (lines > linesLeft) {
+          return { ...entry, files: [], error: `the diff has more than ${TASK_DIFF_MAX_LINES} lines` };
+        }
+        const bytes = jsonEscapedBytes(patches) + lines * TASK_DIFF_LINE_RESULT_BYTES;
+        if (bytes > bytesLeft) {
+          return { ...entry, files: [], error: "the diff is too large to send" };
+        }
+        linesLeft -= lines;
+        bytesLeft -= bytes;
+        return { ...entry, files: parseGitDiff(patches) };
+      }
+      const error =
+        failure ??
+        found?.error ??
+        (bounded ? "the diff exceeded its output bound" : "the diff did not finish");
+      return { ...entry, files: [], error };
+    }),
+  };
 }
 
 function stripOriginPrefix(ref: string): string {
   return ref.startsWith("origin/") ? ref.slice("origin/".length) : ref;
 }
-
-/**
- * List untracked files in the worktree, honouring .gitignore
- * (`--exclude-standard`), capped at {@link MAX_UNTRACKED}. Empty on error.
- */
-async function listUntracked(
-  environment: TaskDiffEnvironment | null,
-  hostCwd: string,
-  environmentCwd: string | null,
-): Promise<string[]> {
-  const raw = await runGitText(environment, hostCwd, environmentCwd, [
-    "ls-files",
-    "--others",
-    "--exclude-standard",
-  ]);
-  if (!raw) return [];
-  return raw
-    .split("\n")
-    .filter((line) => line.length > 0)
-    .slice(0, MAX_UNTRACKED);
-}
-
-/**
- * Run a read-only Git command (host or in-environment) and return trimmed
- * stdout, or null on any failure. Used for base-branch resolution where a
- * missing upstream is expected, not exceptional.
- */
-async function runGitText(
-  environment: TaskDiffEnvironment | null,
-  hostCwd: string,
-  environmentCwd: string | null,
-  args: string[],
-): Promise<string | null> {
-  if (environment) {
-    return tryRunGitTextInEnvironment(environment, environmentCwd!, args);
-  }
-  const result = spawnSync("git", ["-C", hostCwd, ...args], {
-    encoding: "utf8",
-  });
-  if (result.status !== 0) return null;
-  const text = (result.stdout ?? "").trim();
-  return text.length > 0 ? text : null;
-}

package/lib/task-env-source.ts

@@ -18,9 +18,18 @@
  * store). Its observations are stored once and never change. So a change
  * reaches the next command and the next request, while a command that
  * changes nothing reads nothing.
+ *
+ * ADR-154: once the runner begins leaving its own credentials, neither
+ * store is read. On cloud credentials a task's env is what the composer
+ * serves for exactly the run the reading generation serves (/env's gateway
+ * generation, the proxy's live one) while that run is the task's open one,
+ * read afresh every time (its gate closes the moment the run's credentials
+ * do, and no copy of it is kept here). Until the runner is active, a task
+ * gets no project env at all.
  */
 
-import { projectEnvAuthorityRevision, projectEnvRevision } from "./host-env";
+import { activeCloudCredentials, onLeavingLegacy, onOwnCredentials } from "./cloud-credential-host";
+import { noteProjectEnvViewChange, projectEnvAuthorityRevision, projectEnvRevision } from "./host-env";
 import { readProjectEnvAuthoritySnapshot } from "./project-env-authority";
 import { readProjectEnvReplicaSnapshot, readProjectEnvReplicaStatus } from "./project-env-replica";
 import { taskProjectEnvResolver, type TaskEnvSource } from "./project-env-loader";
@@ -32,11 +41,11 @@ import {
   type TaskEnvHead,
   type TaskEnvSnapshot,
 } from "./project-env-task-policy";
-import { getHostTask, hostTaskProjectEnvSpec, type TaskProjectEnvSpec } from "./runtime-state";
+import { getHostTask, hostTaskProjectEnvSpec, readTaskRunEpochState, type TaskProjectEnvSpec } from "./runtime-state";
 import { sidecarMode } from "./sidecar";
 import { taskProxiedEnv } from "./secrets-proxy/policy";
 import { taskTrustEnv } from "./secrets-proxy/readiness";
-import type { TaskGatewayEnvResolver } from "./task-gateway-state";
+import { currentTaskGatewayRun, type TaskGatewayEnvResolver } from "./task-gateway-state";
 
 /** The task's projects, lead first, as its launch pinned them. */
 function projectIdsOf(spec: TaskProjectEnvSpec): string[] {
@@ -52,8 +61,13 @@ function projectIdsOf(spec: TaskProjectEnvSpec): string[] {
  * otherwise the records, values and observations the task's decisions come
  * from.
  */
-export function readTaskEnvSnapshot(taskId: string, spec: TaskProjectEnvSpec): TaskEnvSnapshot | "legacy" | null {
+export function readTaskEnvSnapshot(
+  taskId: string,
+  spec: TaskProjectEnvSpec,
+  runEpoch: number | null,
+): TaskEnvSnapshot | "legacy" | null {
   const projectIds = projectIdsOf(spec);
+  if (!onOwnCredentials()) return cloudTaskEnvSnapshot(taskId, projectIds, runEpoch);
   const key = JSON.stringify([projectEnvAuthorityRevision(), projectIds.map((projectId) => [projectId, projectEnvRevision(projectId)])]);
   const hit = snapshots.get(taskId);
   if (hit?.key === key) return hit.snapshot;
@@ -79,6 +93,33 @@ export function forgetTaskEnvSnapshot(taskId: string): void {
   snapshots.delete(taskId);
 }
 
+/**
+ * ADR-154: the task's env as the composer serves it for `runEpoch`, the
+ * reading generation's run, with the task's own observations; null unless
+ * the runner is active and that run is the task's admitted, open one (a
+ * generation from an older runtime gets nothing while a newer run starts),
+ * or while the composer serves nothing for it.
+ */
+function cloudTaskEnvSnapshot(
+  taskId: string,
+  projectIds: readonly string[],
+  runEpoch: number | null,
+): TaskEnvSnapshot | null {
+  const composer = activeCloudCredentials();
+  if (composer === null || runEpoch === null) return null;
+  const run = readTaskRunEpochState(taskId);
+  if (run === null || !run.assignmentOpen || run.highestRunEpoch !== runEpoch) return null;
+  const served = composer.envSnapshot({ taskId, runEpoch }, projectIds);
+  if (served === null) return null;
+  return snapshotOf(taskId, projectIds, (projectId) =>
+    (served.projects.find((project) => project.projectId === projectId)?.entries ?? []).map((entry) => ({
+      key: entry.state.key,
+      state: entry.state,
+      value: entry.materialization.kind === "installed" ? entry.value : null,
+    })),
+  );
+}
+
 function freshTaskEnvSnapshot(taskId: string, projectIds: readonly string[]): TaskEnvSnapshot | "legacy" | null {
   return sidecarMode() ? replicaTaskEnvSnapshot(taskId, projectIds) : ownedTaskEnvSnapshot(taskId, projectIds);
 }
@@ -152,16 +193,18 @@ function snapshotOf(taskId: string, projectIds: readonly string[], entriesOf: (p
   };
 }
 
-/** Where the task's /env takes its project values from right now. */
-export function taskEnvSource(taskId: string, spec: TaskProjectEnvSpec): TaskEnvSource {
-  const snapshot = readTaskEnvSnapshot(taskId, spec);
+/** Where the task's /env takes its project values from right now, for a
+ *  generation serving `runEpoch`. */
+export function taskEnvSource(taskId: string, spec: TaskProjectEnvSpec, runEpoch: number | null): TaskEnvSource {
+  const snapshot = readTaskEnvSnapshot(taskId, spec, runEpoch);
   if (snapshot === "legacy") return { kind: "stored" };
   if (snapshot === null) return { kind: "none" };
   return { kind: "view", view: taskEnvView(snapshot) };
 }
 
 /** The task's snapshot for its proxy, by task id alone: what its persisted
- *  launch spec names. Nothing is proxied from a store never activated. */
+ *  launch spec names, for the run its live gateway generation serves.
+ *  Nothing is proxied from a store never activated. */
 export function proxyTaskEnvSnapshot(taskId: string): TaskEnvSnapshot | null {
   const task = getHostTask(taskId);
   let spec: TaskProjectEnvSpec | null = null;
@@ -171,23 +214,34 @@ export function proxyTaskEnvSnapshot(taskId: string): TaskEnvSnapshot | null {
     return null;
   }
   if (spec === null) return null;
-  const snapshot = readTaskEnvSnapshot(taskId, spec);
+  const snapshot = readTaskEnvSnapshot(taskId, spec, currentTaskGatewayRun(taskId));
   return snapshot === "legacy" ? null : snapshot;
 }
 
 /** The task's note about the keys it does not get, from the store as it is
  *  now; null when it gets every one, or the store gives no view. */
-export function taskEnvWithheldNoteNow(taskId: string, spec: TaskProjectEnvSpec): string | null {
-  const source = taskEnvSource(taskId, spec);
+export function taskEnvWithheldNoteNow(taskId: string, spec: TaskProjectEnvSpec, runEpoch: number | null): string | null {
+  const source = taskEnvSource(taskId, spec, runEpoch);
   return source.kind === "view" ? taskEnvWithheldNote(source.view.policies) : null;
 }
 
-/** The resolver a loader task's gateway generation renders /env with. */
-export function taskEnvResolver(taskId: string, spec: TaskProjectEnvSpec): TaskGatewayEnvResolver {
+/** The resolver a loader task's gateway generation renders /env with, for
+ *  the run that generation serves (null: one from before run epochs). */
+export function taskEnvResolver(taskId: string, spec: TaskProjectEnvSpec, runEpoch: number | null): TaskGatewayEnvResolver {
   return taskProjectEnvResolver(
     spec,
     () => taskTrustEnv(taskId),
     () => taskProxiedEnv(taskId),
-    () => taskEnvSource(taskId, spec),
+    () => taskEnvSource(taskId, spec, runEpoch),
   );
 }
+
+/**
+ * ADR-154: the moment the runner begins leaving its own credentials, every
+ * read above stops taking their values (each checks `onOwnCredentials()`),
+ * and whoever follows the env (the proxy's trust delivery, which unpins
+ * what is no longer proxied) looks again. Registered once, at boot.
+ */
+export function followLeavingLegacy(): () => void {
+  return onLeavingLegacy(() => noteProjectEnvViewChange());
+}

package/lib/task-environment/anchor.ts

@@ -0,0 +1,31 @@
+/**
+ * ADR-154 §6, for providers whose runtime is a container or a machine they
+ * exec into (Docker, Apple, a machine over ssh): an anchored request runs
+ * as root, the engine supervisor first, which drops to the task user the
+ * request would have run as before it starts the request's own argv.
+ */
+
+/** Who a request with no user runs as in a task runtime, as the engines
+ *  always have (their homes are under /home/node). */
+export const ANCHORED_TASK_USER = "node";
+
+/** `request`, run as root under its anchor; unchanged without one. */
+export function rootAnchoredRequest<
+  T extends {
+    argv: readonly [string, ...string[]];
+    user?: string;
+    anchor?: { readonly prefix: readonly [string, ...string[]] };
+  },
+>(request: T): T {
+  const { anchor } = request;
+  if (!anchor) return request;
+  if (request.user === "root") {
+    throw new Error("an anchored process runs as a task user, never as root");
+  }
+  const { anchor: _anchor, ...rest } = request;
+  return {
+    ...rest,
+    user: "root",
+    argv: [...anchor.prefix, request.user ?? ANCHORED_TASK_USER, "--", ...request.argv],
+  } as unknown as T;
+}

package/lib/task-environment/apple-container.ts

@@ -28,8 +28,10 @@ import {
 } from "./workspace-files";
 import { assertSafeHostTaskId } from "../task-identity";
 import { applyProjectEnvProfile } from "../runtime-authority";
+import { rootAnchoredRequest } from "./anchor";
 import {
   capturedCliExec,
+  cliExecEnv,
   streamingCliExec,
 } from "./docker";
 import {
@@ -37,6 +39,8 @@ import {
   assertTaskEnvironmentProcessRequest,
   refusePrivilegedExec,
   assertTaskEnvironmentSessionRequest,
+  type TaskEnvironmentCallOptions,
+  type TaskEnvironmentReadOptions,
   type TaskEnvironmentCopyRequest,
   type TaskEnvironmentDescriptor,
   type TaskEnvironmentDetachedSessionRequest,
@@ -54,6 +58,7 @@ import {
   type TaskEnvironmentSpawnRequest,
   type TaskEnvironmentStatus,
 } from "./types";
+import type { TaskWriteEnvironment } from "../credential-consumers/task-files";
 
 export const APPLE_TASK_ENVIRONMENT_PROVIDER = "apple-container";
 const APPLE_LOCATOR_SCHEMA_VERSION = 1;
@@ -88,7 +93,13 @@ export interface AppleCliResult {
 
 export type AppleCliRunner = (
   args: readonly string[],
-  options: { timeoutMs: number; maxOutputBytes: number },
+  options: {
+    timeoutMs: number;
+    maxOutputBytes: number;
+    /** The CLI child's own environment, when an exec names a credential
+     * bare (cliExecEnv). Absent, it inherits the runner's. */
+    env?: NodeJS.ProcessEnv;
+  },
 ) => Promise<AppleCliResult>;
 
 export interface AppleContainerTaskEnvironmentDeps<
@@ -137,6 +148,7 @@ export interface AppleContainerProvisioningDeps<TInput, TCredentials, TResult> {
     input: TInput,
     credentials?: TCredentials,
     envMode?: ProjectEnvMode,
+    runtimeEnvironment?: () => TaskWriteEnvironment,
   ) => Promise<TResult>;
   inputTaskId: (input: TInput) => string;
   /** The host worktree path this task will occupy, derivable before task-up
@@ -193,6 +205,9 @@ export function createAppleContainerTaskEnvironmentProvider<
         request.input,
         request.credentials,
         request.envMode ?? "loader",
+        // ADR-154 §12: the container as task-up has created it, for the
+        // runtime-ready writes before uai-init.
+        () => new AppleContainerTaskEnvironmentHandle(preparedLocator, resolved, request.envMode ?? "loader"),
       );
       const prepared = parseAppleTaskEnvironmentLocator(preparedLocator);
       // task-up composes its worktree path in shell from the operator's
@@ -271,6 +286,8 @@ class AppleContainerTaskEnvironmentHandle
 {
   readonly descriptor: TaskEnvironmentDescriptor;
   readonly durableIdentity: string;
+  /** ADR-154 §6: anchored requests start under the engine supervisor. */
+  readonly anchors = true;
   readonly #value: AppleTaskEnvironmentLocatorValue;
 
   constructor(
@@ -288,16 +305,19 @@ class AppleContainerTaskEnvironmentHandle
     };
   }
 
-  async readWorkspaceFile(filePath: string): Promise<Uint8Array | null> {
+  async readWorkspaceFile(filePath: string, options?: TaskEnvironmentReadOptions): Promise<Uint8Array | null> {
+    options?.admit?.();
     return hostWorkspaceRead(
       this.descriptor,
       path.join(this.#value.hostWorktreePath, "workspace"),
       filePath,
+      options,
     );
   }
 
-  async writeWorkspaceFile(filePath: string, bytes: Uint8Array): Promise<void> {
-    hostWorkspaceWrite(
+  async writeWorkspaceFile(filePath: string, bytes: Uint8Array, options?: TaskEnvironmentCallOptions): Promise<void> {
+    options?.admit?.();
+    await hostWorkspaceWrite(
       this.descriptor,
       path.join(this.#value.hostWorktreePath, "workspace"),
       filePath,
@@ -309,16 +329,22 @@ class AppleContainerTaskEnvironmentHandle
     assertTaskEnvironmentExecRequest(request);
     refusePrivilegedExec(request);
     const profiled = applyProjectEnvProfile(
-      request,
+      rootAnchoredRequest(request),
       this.descriptor.envMode ?? "baked",
       "/usr/bin/zsh",
     );
     request.admit?.();
+    const invocation = appleExecArgs(
+      this.#value.containerName,
+      profiled,
+      "interactive",
+    );
     return capturedCliExec(
       this.deps.spawn,
       this.deps.containerCliPath(),
-      appleExecArgs(this.#value.containerName, profiled, "interactive"),
+      invocation.args,
       profiled,
+      invocation.env,
     );
   }
 
@@ -327,15 +353,22 @@ class AppleContainerTaskEnvironmentHandle
   ): Promise<TaskEnvironmentProcess> {
     assertTaskEnvironmentProcessRequest(request);
     const profiled = applyProjectEnvProfile(
-      request,
+      rootAnchoredRequest(request),
       this.descriptor.envMode ?? "baked",
       "/usr/bin/zsh",
     );
+    const invocation = appleExecArgs(
+      this.#value.containerName,
+      profiled,
+      "interactive",
+    );
+    request.admit?.();
     return streamingCliExec(
       this.deps.spawn,
       this.deps.containerCliPath(),
-      appleExecArgs(this.#value.containerName, profiled, "interactive"),
+      invocation.args,
       profiled,
+      invocation.env,
     );
   }
 
@@ -344,15 +377,22 @@ class AppleContainerTaskEnvironmentHandle
   ): Promise<TaskEnvironmentProcess> {
     assertTaskEnvironmentSessionRequest(request);
     const profiled = applyProjectEnvProfile(
-      request,
+      rootAnchoredRequest(request),
       this.descriptor.envMode ?? "baked",
       "/usr/bin/zsh",
     );
+    const invocation = appleExecArgs(
+      this.#value.containerName,
+      profiled,
+      "interactive",
+    );
+    request.admit?.();
     return streamingCliExec(
       this.deps.spawn,
       this.deps.containerCliPath(),
-      appleExecArgs(this.#value.containerName, profiled, "interactive"),
+      invocation.args,
       profiled,
+      invocation.env,
     );
   }
 
@@ -361,17 +401,21 @@ class AppleContainerTaskEnvironmentHandle
   ): Promise<TaskEnvironmentExecResult> {
     assertTaskEnvironmentSessionRequest(request);
     const profiled = applyProjectEnvProfile(
-      request,
+      rootAnchoredRequest(request),
       this.descriptor.envMode ?? "baked",
       "/usr/bin/zsh",
     );
-    const result = await this.deps.run(
-      appleExecArgs(this.#value.containerName, profiled, "detached"),
-      {
-        timeoutMs: request.launchTimeoutMs,
-        maxOutputBytes: request.maxOutputBytes,
-      },
+    const invocation = appleExecArgs(
+      this.#value.containerName,
+      profiled,
+      "detached",
     );
+    request.admit?.();
+    const result = await this.deps.run(invocation.args, {
+      timeoutMs: request.launchTimeoutMs,
+      maxOutputBytes: request.maxOutputBytes,
+      ...(invocation.env === undefined ? {} : { env: invocation.env }),
+    });
     return {
       exitCode: result.status,
       signal: null,
@@ -396,6 +440,7 @@ class AppleContainerTaskEnvironmentHandle
             `${this.#value.containerName}:${request.source}`,
             request.destination,
           ];
+    request.admit?.();
     const result = await this.deps.run(args, {
       timeoutMs: 120_000,
       maxOutputBytes: 1024 * 1024,
@@ -598,6 +643,8 @@ class AppleContainerTaskEnvironmentHandle
   }
 }
 
+/** The argv of one `container exec`, and the environment the CLI must run
+ * with to resolve the credentials it names (cliExecEnv). */
 function appleExecArgs(
   containerName: string,
   request:
@@ -606,20 +653,13 @@ function appleExecArgs(
     | TaskEnvironmentSessionRequest
     | TaskEnvironmentDetachedSessionRequest,
   mode: "interactive" | "detached",
-): string[] {
+): { args: string[]; env: NodeJS.ProcessEnv | undefined } {
   const args = ["exec", mode === "detached" ? "-d" : "-i"];
   if (request.cwd) args.push("--workdir", request.cwd);
   if (request.user) args.push("--user", request.user);
-  for (const name of request.inheritEnv ?? []) {
-    if (process.env[name] !== undefined) args.push("--env", name);
-  }
-  for (const [name, value] of Object.entries(request.env ?? {}).sort(
-    ([left], [right]) => left.localeCompare(right),
-  )) {
-    args.push("--env", `${name}=${value}`);
-  }
-  args.push(containerName, ...request.argv);
-  return args;
+  const execEnv = cliExecEnv(request);
+  args.push(...execEnv.args, containerName, ...request.argv);
+  return { args, env: execEnv.env };
 }
 
 export function appleCliRunner(
@@ -633,6 +673,7 @@ function defaultRunner(containerCliPath: () => string): AppleCliRunner {
     new Promise((resolve) => {
       const child = nodeSpawn(containerCliPath(), [...args], {
         stdio: ["ignore", "pipe", "pipe"],
+        ...(options.env === undefined ? {} : { env: options.env }),
       });
       const stdout: Buffer[] = [];
       const stderr: Buffer[] = [];