@runuai/host 0.9.150 → 0.9.151

package/lib/git-diff.ts

@@ -11,12 +11,11 @@
  * is small and the chat-side Markdown renderer already sets the
  * dependency-free precedent (see components/markdown.tsx).
  */
-import { spawn } from "node:child_process";
 
 import { RUNTIME_AUTHORITY_ENV } from "./runtime-authority";
 import type {
+  TaskEnvironmentExecRequest,
   TaskEnvironmentExecResult,
-  TaskEnvironmentHandle,
 } from "./task-environment/types";
 
 export type DiffStatus =
@@ -61,15 +60,9 @@ export interface DiffFile {
   hunks: DiffHunk[];
 }
 
-const GIT_DIFF_ARGS = [
-  "-c",
-  "core.quotepath=false",
-  "diff",
-  "--no-color",
-  "--no-ext-diff",
-  "--src-prefix=a/",
-  "--dst-prefix=b/",
-];
+/** How every patch is rendered: no colour, no external diff driver, the
+ *  usual a/ b/ prefixes, paths as they are. */
+const GIT_DIFF_ARGS = "-c core.quotepath=false diff --no-color --no-ext-diff --src-prefix=a/ --dst-prefix=b/";
 
 const NON_INTERACTIVE_GIT_ENV = {
   GIT_TERMINAL_PROMPT: "0",
@@ -77,198 +70,247 @@ const NON_INTERACTIVE_GIT_ENV = {
   GIT_SSH_COMMAND: "ssh -o BatchMode=yes",
 };
 
-const TASK_ENVIRONMENT_GIT_TIMEOUT_MS = 120_000;
-const TASK_ENVIRONMENT_GIT_OUTPUT_BYTES = 64 * 1024 * 1024;
-const TASK_ENVIRONMENT_GIT_TEXT_OUTPUT_BYTES = 4 * 1024 * 1024;
-
-type TaskEnvironmentExecutor = Pick<TaskEnvironmentHandle, "exec">;
+/** A diff's bound on what each of a project's producers may give: its
+ *  tracked patches, and its untracked ones. Past it, the project's diff is
+ *  an error, never a partial patch. */
+export const TASK_DIFF_PATCH_BYTES = 8 * 1024 * 1024;
+/** A diff's bound on its whole output, however many projects it has: the
+ *  projects past it are errors. */
+export const TASK_DIFF_OUTPUT_BYTES = 48 * 1024 * 1024;
+/** A diff's bound on the lines it renders, every project of it: each line
+ *  becomes an object, so a valid patch of millions of tiny lines within the
+ *  byte bounds would otherwise cost the runner hundreds of MiB to parse. A
+ *  project that would pass what is left of it is an error, unparsed. */
+export const TASK_DIFF_MAX_LINES = 100_000;
+/** A diff's bound on its result as the runner sends it: JSON-escaped, a
+ *  patch's control bytes take six bytes each, so patches within the byte and
+ *  line bounds could still serialize past the bridge's frame limit (100 MiB)
+ *  and get the runner's connection closed. A project that would pass what is
+ *  left of it is an error, unparsed. */
+export const TASK_DIFF_RESULT_BYTES = 48 * 1024 * 1024;
+/** What each rendered line adds to the result beyond its own text: its
+ *  object, keys and line numbers. */
+export const TASK_DIFF_LINE_RESULT_BYTES = 96;
+/** What each project's entry may take in the result besides its files: its
+ *  id, name, path, base and error, each at its bound and JSON-escaped at
+ *  worst, and their keys. Reserved from the result bound up front. */
+export const TASK_DIFF_REPO_RESULT_BYTES = 16 * 1024;
+/** A project's reported error, and its base, at most: both are the task's
+ *  own (its Git's stderr, its remote's default branch). */
+export const TASK_DIFF_ERROR_CHARS = 1024;
+export const TASK_DIFF_BASE_CHARS = 256;
+/** How long a diff may take, every project of it: it is killed inside its
+ *  runtime past this, everything it started with it. */
+export const TASK_DIFF_TIMEOUT_MS = 300_000;
+/** Cap how many untracked files are rendered as new-file patches, so a
+ *  pathological untracked directory that slips past .gitignore cannot
+ *  turn one diff into thousands of patches. */
+export const MAX_UNTRACKED = 200;
 
 /**
- * Run `git diff <range>` in `cwd` and return the raw unified-diff text.
- * Throws if git exits non-zero. Empty diff returns an empty string.
+ * `bounded CMD...` (POSIX sh): runs CMD with its output in `$tmp/out` (at
+ * most `$limit` bytes), its errors in `$tmp/err` (at most 4 KiB) and its
+ * status in `$tmp/status`. Each stream goes through a pipe whose reader
+ * stops at its bound, so a writer past it is stopped (SIGPIPE) and nothing
+ * past it is held, in memory or on disk.
  */
-export function runGitDiff(cwd: string, range: string): Promise<string> {
-  return runDiffCommand(
-    "git",
-    ["-C", cwd, ...GIT_DIFF_ARGS, range],
-    "git diff",
-    {
-      ...process.env,
-      ...NON_INTERACTIVE_GIT_ENV,
-    },
-  );
-}
+export const TASK_DIFF_BOUNDED = [
+  "bounded() {",
+  '  echo 1 >"$tmp/status"',
+  '  { { "$@"; echo "$?" >"$tmp/status"; } 2>&1 1>&3 3>&- | head -c 4096 >"$tmp/err"; } 3>&1 | head -c "$limit" >"$tmp/out"',
+  "}",
+].join("\n");
 
 /**
- * Run `git diff <range>` inside a running task environment.
+ * A task's whole diff, as one POSIX sh run in the task's environment (its
+ * runtime while it runs, a stopped task's sandbox otherwise; never the
+ * host, #cb3j0z): `$1` the bound on each producer's bytes, `$2` the
+ * untracked bound, `$3` the bound on the whole output, then each project's
+ * directory below the working directory. For each project it resolves the
+ * base (the remote's default branch, `origin/HEAD`, else `origin/main`:
+ * never the worktree's upstream, which flips to the pushed task branch and
+ * would hide all committed work), diffs the merge-base against the working
+ * tree (committed + staged + unstaged), and renders each untracked file
+ * (honouring .gitignore) as a new-file patch.
+ *
+ * Whatever runs for it, the task's own config drivers included, is bounded
+ * where it writes: its output at one byte past the bound and its errors at
+ * 4 KiB, each through a pipe that stops the writer once full, so nothing it
+ * produces is held beyond that, in memory or on disk.
  *
- * Running diff there keeps all Git credential behavior
- * inside the task sandbox instead of leaking to the host's SSH agent
- * (for example macOS 1Password confirmation prompts).
+ * Every value is a line `<kind> <base64>`, so any bytes survive whatever
+ * carries them: `P` a project, then either `E` an error, or `B` its base,
+ * `D` its tracked patches and `U` its untracked ones (or `E`). The whole
+ * output stops at its bound.
  */
-export function runGitDiffInEnvironment(
-  environment: TaskEnvironmentExecutor,
-  cwd: string,
-  range: string,
-): Promise<string> {
-  return runEnvironmentGitCommand(
-    environment,
-    cwd,
-    [...GIT_DIFF_ARGS, range],
-    "task environment git diff",
-    false,
-    TASK_ENVIRONMENT_GIT_OUTPUT_BYTES,
-  );
-}
+export const TASK_DIFF_SCRIPT = [
+  "set -u",
+  'each=$1; most=$2; cap=$3; shift 3',
+  'limit=$((each + 1))',
+  'tmp=$(mktemp -d "${TMPDIR:-/tmp}/uai-task-diff.XXXXXX") || exit 70',
+  "trap 'rm -rf \"$tmp\"' EXIT",
+  "root=$(pwd)",
+  'frame() { printf "%s " "$1"; base64 -w0 <"$2"; printf "\\n"; }',
+  'value() { printf "%s" "$2" >"$tmp/value"; frame "$1" "$tmp/value"; }',
+  TASK_DIFF_BOUNDED,
+  'over() { [ "$(wc -c <"$tmp/out")" -gt "$each" ]; }',
+  "untracked() {",
+  '  git ls-files --others --exclude-standard -z 2>/dev/null | head -z -n "$most" \\',
+  `    | xargs -0 -r -n 1 sh -c 'git ${GIT_DIFF_ARGS} --no-index -- /dev/null "$1"; [ $? -le 1 ] || exit 255' untracked`,
+  "}",
+  "projects() {",
+  '  for slug in "$@"; do',
+  '    value P "$slug"',
+  '    if ! cd -- "$root/$slug" 2>/dev/null; then value E "not a project directory: $slug"; continue; fi',
+  "    base=$(git rev-parse --abbrev-ref origin/HEAD 2>/dev/null) || base=",
+  '    [ -n "$base" ] || base=origin/main',
+  '    value B "$base"',
+  '    merge=$(git merge-base "$base" HEAD 2>/dev/null) || merge=',
+  '    [ -n "$merge" ] || merge=$base',
+  `    bounded git ${GIT_DIFF_ARGS} "$merge"`,
+  '    if over; then value E "the diff exceeded $each bytes"',
+  '    elif [ "$(cat "$tmp/status")" != 0 ]; then frame E "$tmp/err"',
+  "    else",
+  '      frame D "$tmp/out"',
+  "      bounded untracked",
+  '      if over; then value E "the untracked files exceeded $each bytes"',
+  '      elif [ "$(cat "$tmp/status")" != 0 ]; then frame E "$tmp/err"',
+  '      else frame U "$tmp/out"; fi',
+  "    fi",
+  '    cd -- "$root"',
+  "  done",
+  "}",
+  'projects "$@" | head -c "$cap"',
+].join("\n");
 
 /**
- * Render a single untracked file as a new-file patch by diffing it against
- * `/dev/null` with `--no-index`. `git diff <commit>` omits untracked files
- * entirely, so this is how they reach the "all changes vs base" view.
- *
- * `--no-index` exits 1 when the inputs differ (the normal "there is a diff"
- * case for a new file) and 0 when identical — both are success here; only
- * code > 1 is a real error.
+ * The one exec of a task's diff of `slugs`, below `workspacePath`: killed
+ * inside the runtime at its deadline, the shell and everything it started
+ * (`timeout` signals their whole group), however the client that started it
+ * ended.
  */
-export function runGitDiffUntracked(
-  cwd: string,
-  relPath: string,
-): Promise<string> {
-  return runDiffCommand(
-    "git",
-    ["-C", cwd, ...GIT_DIFF_ARGS, "--no-index", "--", "/dev/null", relPath],
-    "git diff --no-index",
-    { ...process.env, ...NON_INTERACTIVE_GIT_ENV },
-    true,
-  );
+export function taskDiffRequest(
+  workspacePath: string,
+  slugs: readonly string[],
+): TaskEnvironmentExecRequest {
+  return {
+    projectEnvProfile: "maintenance",
+    argv: [
+      "/usr/bin/timeout",
+      "--signal=KILL",
+      String(TASK_DIFF_TIMEOUT_MS / 1000),
+      "/bin/sh",
+      "-c",
+      TASK_DIFF_SCRIPT,
+      "uai-task-diff",
+      String(TASK_DIFF_PATCH_BYTES),
+      String(MAX_UNTRACKED),
+      String(TASK_DIFF_OUTPUT_BYTES),
+      ...slugs,
+    ],
+    cwd: workspacePath,
+    env: { ...RUNTIME_AUTHORITY_ENV, ...NON_INTERACTIVE_GIT_ENV },
+    // The client's own bound, past the runtime's.
+    timeoutMs: TASK_DIFF_TIMEOUT_MS + 15_000,
+    // The script stops at its bound; past it, the exec itself is cut.
+    maxOutputBytes: TASK_DIFF_OUTPUT_BYTES + 1024 * 1024,
+  };
 }
 
-/** In-environment variant of {@link runGitDiffUntracked}. */
-export function runGitDiffUntrackedInEnvironment(
-  environment: TaskEnvironmentExecutor,
-  cwd: string,
-  relPath: string,
-): Promise<string> {
-  return runEnvironmentGitCommand(
-    environment,
-    cwd,
-    [
-      ...GIT_DIFF_ARGS,
-      "--no-index",
-      "--",
-      "/dev/null",
-      relPath,
-    ],
-    "task environment git diff --no-index",
-    true,
-    TASK_ENVIRONMENT_GIT_OUTPUT_BYTES,
-  );
+/**
+ * The bytes `JSON.stringify(text)` takes, counted without making it: two
+ * for each quote or backslash and for each control character with a short
+ * escape, six for any other control character or lone surrogate, and each
+ * other character's UTF-8 width, plus the quotes around it.
+ */
+export function jsonEscapedBytes(text: string): number {
+  let bytes = 2;
+  for (let index = 0; index < text.length; index += 1) {
+    const code = text.charCodeAt(index);
+    if (code === 0x22 || code === 0x5c) bytes += 2;
+    else if (code < 0x20) {
+      bytes += code === 0x08 || code === 0x09 || code === 0x0a || code === 0x0c || code === 0x0d ? 2 : 6;
+    } else if (code < 0x80) bytes += 1;
+    else if (code < 0x800) bytes += 2;
+    else if (code >= 0xd800 && code <= 0xdbff && index + 1 < text.length && (text.charCodeAt(index + 1) & 0xfc00) === 0xdc00) {
+      bytes += 4;
+      index += 1;
+    } else if (code >= 0xd800 && code <= 0xdfff) bytes += 6;
+    else bytes += 3;
+  }
+  return bytes;
 }
 
-/** Best-effort read-only Git query used for base/untracked discovery. */
-export async function tryRunGitTextInEnvironment(
-  environment: TaskEnvironmentExecutor,
-  cwd: string,
-  args: string[],
-): Promise<string | null> {
-  try {
-    const text = await runEnvironmentGitCommand(
-      environment,
-      cwd,
-      args,
-      "task environment git query",
-      false,
-      TASK_ENVIRONMENT_GIT_TEXT_OUTPUT_BYTES,
-    );
-    const trimmed = text.trim();
-    return trimmed.length > 0 ? trimmed : null;
-  } catch {
-    return null;
+/** How many lines `text` holds, counted without parsing it (the last one
+ *  counts without its newline). */
+export function countDiffLines(text: string): number {
+  let lines = 0;
+  let at = text.indexOf("\n");
+  while (at !== -1) {
+    lines += 1;
+    at = text.indexOf("\n", at + 1);
   }
+  return text.length > 0 && !text.endsWith("\n") ? lines + 1 : lines;
 }
 
-async function runEnvironmentGitCommand(
-  environment: TaskEnvironmentExecutor,
-  cwd: string,
-  args: string[],
-  label: string,
-  allowExitOne: boolean,
-  maxOutputBytes: number,
-): Promise<string> {
-  const result = await environment.exec({
-    projectEnvProfile: "maintenance",
-    argv: ["/usr/bin/git", ...args],
-    cwd,
-    env: { ...RUNTIME_AUTHORITY_ENV, ...NON_INTERACTIVE_GIT_ENV },
-    timeoutMs: TASK_ENVIRONMENT_GIT_TIMEOUT_MS,
-    maxOutputBytes,
-  });
-  return requireEnvironmentGitSuccess(
-    result,
-    label,
-    allowExitOne,
-    maxOutputBytes,
-  );
+/** One project of a diff's output. */
+export interface TaskDiffProjectOutput {
+  slug: string;
+  base?: string;
+  /** Its tracked patches, then its untracked ones. */
+  patches?: string;
+  tracked?: boolean;
+  untracked?: boolean;
+  error?: string;
 }
 
-function requireEnvironmentGitSuccess(
-  result: TaskEnvironmentExecResult,
-  label: string,
-  allowExitOne: boolean,
-  maxOutputBytes: number,
-): string {
-  if (result.stdoutTruncated || result.stderrTruncated) {
-    throw new Error(`${label} exceeded ${maxOutputBytes} output bytes`);
-  }
-  if (result.exitCode === 0 || (allowExitOne && result.exitCode === 1)) {
-    return Buffer.from(result.stdout).toString("utf8");
+/**
+ * The projects of a diff's output (`TASK_DIFF_SCRIPT`), in order. Only whole
+ * lines count: a line the bound cut short is dropped, and its project is
+ * left without the value.
+ */
+export function parseTaskDiffOutput(output: string): TaskDiffProjectOutput[] {
+  const projects: TaskDiffProjectOutput[] = [];
+  const lines = output.split("\n");
+  // The last element follows the last newline: whole only when empty.
+  lines.pop();
+  for (const line of lines) {
+    if (line.length < 2 || line[1] !== " " || !/^[A-Za-z0-9+/]*={0,2}$/.test(line.slice(2))) continue;
+    const value = Buffer.from(line.slice(2), "base64").toString("utf8");
+    const kind = line[0];
+    if (kind === "P") {
+      projects.push({ slug: value });
+      continue;
+    }
+    const project = projects.at(-1);
+    if (!project) continue;
+    if (kind === "B") project.base = value.slice(0, TASK_DIFF_BASE_CHARS);
+    else if (kind === "E") project.error = value.trim().slice(0, TASK_DIFF_ERROR_CHARS) || "the diff failed";
+    else if (kind === "D") {
+      project.patches = value;
+      project.tracked = true;
+    } else if (kind === "U") {
+      if (project.patches && value.length > 0 && !project.patches.endsWith("\n")) project.patches += "\n";
+      project.patches = (project.patches ?? "") + value;
+      project.untracked = true;
+    }
   }
-  const stderr = Buffer.from(result.stderr)
-    .toString("utf8")
-    .trim()
-    .slice(0, 4_096);
+  return projects;
+}
+
+/** Why a diff's exec gave nothing to parse: no exit, a failed one, or an
+ *  output past its bound. Null when it can be parsed. */
+export function taskDiffExecFailure(result: TaskEnvironmentExecResult): string | null {
+  if (result.stdoutTruncated || result.stderrTruncated) return "the diff exceeded its output bound";
+  if (result.exitCode === 0) return null;
+  const stderr = Buffer.from(result.stderr).toString("utf8").trim().slice(0, TASK_DIFF_ERROR_CHARS - 64);
   const outcome =
     result.exitCode === null
       ? result.signal
         ? `was terminated by ${result.signal}`
         : "did not start"
       : `exited ${result.exitCode}`;
-  throw new Error(`${label} ${outcome}${stderr ? `: ${stderr}` : ""}`);
-}
-
-function runDiffCommand(
-  command: string,
-  args: string[],
-  label: string,
-  env: NodeJS.ProcessEnv,
-  /** Treat exit code 1 as success — `git diff --no-index` returns 1 when the
-   *  compared inputs differ, which for a new-file patch is the expected case. */
-  allowExitOne = false,
-): Promise<string> {
-  return new Promise((res, rej) => {
-    // Force ASCII paths and pull a generous unified context so the UI
-    // can render meaningful blocks. No color codes.
-    const child = spawn(command, args, {
-      env,
-      stdio: ["ignore", "pipe", "pipe"],
-    });
-    let stdout = "";
-    let stderr = "";
-    child.stdout.on("data", (b) => {
-      stdout += b.toString("utf8");
-    });
-    child.stderr.on("data", (b) => {
-      stderr += b.toString("utf8");
-    });
-    child.on("error", rej);
-    child.on("close", (code) => {
-      if (code === 0 || (allowExitOne && code === 1)) {
-        res(stdout);
-        return;
-      }
-      rej(new Error(`${label} exited ${code}: ${stderr.trim()}`));
-    });
-  });
+  return `the task diff ${outcome}${stderr ? `: ${stderr}` : ""}`;
 }
 
 /**

package/lib/git-identity.ts

@@ -24,6 +24,7 @@ import {
   taskAppContainerState,
   taskContainerCli,
 } from "./task-container-cli";
+import { onOwnCredentials, whileOnOwnCredentials } from "./cloud-credential-host";
 import { runtimeAuthorityDockerExecArgs } from "./runtime-authority";
 import { RUNTIME_AUTHORITY_ENV } from "./runtime-authority";
 import { assertSafeHostTaskId } from "./task-identity";
@@ -148,7 +149,7 @@ export async function setupTaskGitIdentity(
 // 2026-08-26). The wildcard principal is deliberate: the task key is the
 // container's only signer, and the identity email may not be configured yet
 // when the key lands.
-const SSH_SIGNING_CONFIG =
+export const SSH_SIGNING_CONFIG =
   "/usr/bin/git config --global gpg.format ssh" +
   " && /usr/bin/git config --global user.signingkey /home/node/.ssh/id_ed25519.pub" +
   " && /usr/bin/git config --global commit.gpgsign true" +
@@ -156,7 +157,7 @@ const SSH_SIGNING_CONFIG =
   ' && /usr/bin/printf \'* %s\\n\' "$(/bin/cat /home/node/.ssh/id_ed25519.pub)" > /home/node/.ssh/allowed_signers' +
   " && /usr/bin/git config --global gpg.ssh.allowedSignersFile /home/node/.ssh/allowed_signers";
 
-const SSH_TRANSPORT_CONFIG =
+export const SSH_TRANSPORT_CONFIG =
   "/usr/bin/git config --global --unset-all 'url.https://github.com/.insteadOf' >/dev/null 2>&1 || true; " +
   "/usr/bin/git config --global --replace-all 'url.git@github.com:.insteadOf' 'https://github.com/'; " +
   '/usr/bin/git config --global core.sshCommand "ssh -o StrictHostKeyChecking=accept-new"';
@@ -275,34 +276,54 @@ interface SshEnsureInFlight {
 
 const sshEnsureInFlight = new Map<string, SshEnsureInFlight>();
 const sshDeleteInFlight = new Map<string, Promise<void>>();
+/** Temporary assignment fence: cleanup seals a task, joins the older ensure,
+ * and deletes the copied key. A later safe assignment may explicitly reopen
+ * the task id. */
+const sealedTaskSshEnsures = new Set<string>();
 /** Durable for this host process: an orphan id is immutable/non-reused, and
  * no later channel/recovery continuation may materialize its private key. */
 const retiredTaskSshEnsures = new Set<string>();
 
-/** Fence future task SSH ensures and join the exact older materialization, if
- * any. This is stronger than deleting the directory once: channel startup and
- * runtime recovery intentionally launch SSH reconciliation in the background,
- * and an older health probe can otherwise resume by writing the key after GC
- * has already checked absence. Never rejects; strict removal is the final
- * filesystem authority and will surface any cleanup failure to the cloud. */
-export async function retireTaskSshIdentityEnsures(
+export async function sealTaskSshIdentityEnsures(
   taskId: string,
 ): Promise<void> {
   assertSafeHostTaskId(taskId);
-  retiredTaskSshEnsures.add(taskId);
+  sealedTaskSshEnsures.add(taskId);
   for (;;) {
     const current = sshEnsureInFlight.get(taskId);
     if (!current) return;
     await current.promise.catch(() => false);
-    // The tracked promise includes write/copy/finally-remove. Its outer caller
-    // performs only authority bookkeeping after this point, so clearing the
-    // matching entry is safe and avoids depending on microtask ordering.
     if (sshEnsureInFlight.get(taskId) === current) {
       sshEnsureInFlight.delete(taskId);
     }
   }
 }
 
+export function openTaskSshIdentityEnsures(taskId: string): void {
+  assertSafeHostTaskId(taskId);
+  if (retiredTaskSshEnsures.has(taskId)) {
+    throw new Error(`task ${taskId} has been permanently retired`);
+  }
+  if (sshEnsureInFlight.has(taskId)) {
+    throw new Error(`task ${taskId} still has an SSH identity writer`);
+  }
+  sealedTaskSshEnsures.delete(taskId);
+}
+
+/** Fence future task SSH ensures and join the exact older materialization, if
+ * any. This is stronger than deleting the directory once: channel startup and
+ * runtime recovery intentionally launch SSH reconciliation in the background,
+ * and an older health probe can otherwise resume by writing the key after GC
+ * has already checked absence. Never rejects; strict removal is the final
+ * filesystem authority and will surface any cleanup failure to the cloud. */
+export async function retireTaskSshIdentityEnsures(
+  taskId: string,
+): Promise<void> {
+  assertSafeHostTaskId(taskId);
+  retiredTaskSshEnsures.add(taskId);
+  await sealTaskSshIdentityEnsures(taskId);
+}
+
 function sshPublicKeyFingerprint(publicKey: string): string | null {
   const [, encoded] = publicKey.trim().split(/\s+/, 3);
   if (!encoded) return null;
@@ -364,7 +385,25 @@ export async function ensureTaskSshIdentity(
   exec: DockerExec = defaultExec,
   deps: EnsureTaskSshIdentityDeps = {},
 ): Promise<boolean> {
-  if (retiredTaskSshEnsures.has(taskId)) return false;
+  // ADR-154: the runner's own SSH key reaches a task only while the runner
+  // is on its own credentials; leaving them waits for a copy under way.
+  return (
+    (await whileOnOwnCredentials(() => ensureOwnTaskSshIdentity(taskId, ownerUserId, exec, deps))) ?? false
+  );
+}
+
+async function ensureOwnTaskSshIdentity(
+  taskId: string,
+  ownerUserId: string | null | undefined,
+  exec: DockerExec,
+  deps: EnsureTaskSshIdentityDeps,
+): Promise<boolean> {
+  if (
+    retiredTaskSshEnsures.has(taskId) ||
+    sealedTaskSshEnsures.has(taskId)
+  ) {
+    return false;
+  }
   if (ownerUserId) {
     const deleting = sshDeleteInFlight.get(ownerUserId);
     if (deleting) {
@@ -433,6 +472,9 @@ async function ensureTaskSshIdentityOnce(
   // Fast path: the DB-authoritative key is already good → re-assert only the
   // cheap signing config and skip docker cp churn.
   if (await sshKeyHealthy(taskId, expectedPublicKey, exec, environment)) {
+    // ADR-154: after the probe too, nothing is written once the runner has
+    // begun leaving its own credentials.
+    if (!onOwnCredentials()) return false;
     const config: [string, ...string[]] = ["/bin/sh", "-c", SSH_SIGNING_CONFIG];
     const configured = environment
       ? await environmentStep(environment, config)
@@ -440,6 +482,9 @@ async function ensureTaskSshIdentityOnce(
     return configured.status === 0;
   }
 
+  // ADR-154: the last hop, fenced: no key is materialized or copied once the
+  // runner has begun leaving its own credentials.
+  if (!onOwnCredentials()) return false;
   const dir = writeIdentity(taskId, ownerUserId);
   if (!dir) {
     console.log(`[ssh] task ${taskId}: no SSH signing identity for its owner`);

package/lib/github-origin.ts

@@ -0,0 +1,28 @@
+/**
+ * GitHub's REST origin for every request that carries a person's token or
+ * the App's own credentials (the repository picker, token revocation).
+ *
+ * An installed host always talks to https://api.github.com. Only a
+ * development or test launch may point UAI_GITHUB_API_URL elsewhere (the
+ * fake GitHub the browser e2e runs against), and then only at an http(s)
+ * origin with no userinfo. An installed service leaves NODE_ENV unset, so
+ * "not production" would let a stray override send credentials anywhere; a
+ * development launch is told by the markers in lib/launch-mode instead.
+ */
+
+import { isDevelopmentLaunch, type LaunchEnv } from "./launch-mode";
+
+export const GITHUB_API_ORIGIN = "https://api.github.com";
+
+/** The origin to send GitHub credentials to. Throws on a malformed override
+ *  in a development launch, never falls through to it otherwise. */
+export function githubApiOrigin(env: LaunchEnv & { UAI_GITHUB_API_URL?: string } = process.env): string {
+  if (!isDevelopmentLaunch(env)) return GITHUB_API_ORIGIN;
+  const configured = env.UAI_GITHUB_API_URL?.trim();
+  if (!configured) return GITHUB_API_ORIGIN;
+  const url = new URL(configured);
+  if ((url.protocol !== "http:" && url.protocol !== "https:") || url.username || url.password) {
+    throw new Error("UAI_GITHUB_API_URL must be an HTTP(S) origin");
+  }
+  return url.origin;
+}