@runuai/host 0.9.150 → 0.9.151

package/lib/task-environment/machine-task-up.ts

@@ -21,11 +21,13 @@ import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { promisify } from "node:util";
 
-import type {
-  TaskDownResult,
-  TaskLaunchInput,
-  TaskUpCredentials,
-  TaskUpResult,
+import {
+  AgentError,
+  assertLeasedTaskUp,
+  type TaskDownResult,
+  type TaskLaunchInput,
+  type TaskUpCredentials,
+  type TaskUpResult,
 } from "../agent";
 import { injectCodexIntoMachine } from "../codex-auth";
 import {
@@ -59,13 +61,16 @@ import {
   type MachineTaskInput,
 } from "./machine";
 import type {
+  TaskEnvironmentCallOptions,
   ProjectEnvMode,
   TaskEnvironmentDescriptor,
   TaskEnvironmentHandle,
+  TaskEnvironmentProcess,
   TaskEnvironmentProvider,
   TaskEnvironmentProvisionRequest,
   TaskEnvironmentProvisioned,
 } from "./types";
+import { TASK_SSH_KEY_PATH } from "../credential-consumers/github";
 
 /** In-machine clone budget per project. */
 const CLONE_TIMEOUT_MS = 10 * 60_000;
@@ -102,6 +107,9 @@ export interface MachineHostTaskUpDeps {
   ) => Promise<string | null>;
   /** Test seam for the host-side persistent reverse-tunnel supervisor. */
   ensureGatewayTunnel?: typeof ensureMachineGatewayTunnelReady;
+  /** How long a start that is not one waits for the stages it left running
+   *  (tests). */
+  abandonJoinMs?: number;
 }
 
 async function startMachineTaskForwarder(
@@ -196,15 +204,31 @@ async function execWithStdin(
   argv: readonly [string, ...string[]],
   stdin: string,
   timeoutMs: number,
+  /** Aborted: the process is ended at once (ADR-154 §12, a withdrawn start). */
+  signal?: AbortSignal,
+  user?: string,
 ): Promise<StepResult> {
+  if (signal?.aborted) throw new Error(WITHDRAWN);
   const proc = await handle.spawn({
     argv,
+    ...(user === undefined ? {} : { user }),
     projectEnvProfile: "maintenance",
     inheritEnv: [],
     env: { GIT_TERMINAL_PROMPT: "0" },
     timeoutMs,
     maxOutputBytes: STEP_OUTPUT_BYTES,
   });
+  const onAbort = (): void => void proc.terminate("SIGKILL").catch(() => {});
+  if (signal?.aborted) onAbort();
+  else signal?.addEventListener("abort", onAbort, { once: true });
+  try {
+    return await drainStep(proc, stdin);
+  } finally {
+    signal?.removeEventListener("abort", onAbort);
+  }
+}
+
+async function drainStep(proc: TaskEnvironmentProcess, stdin: string): Promise<StepResult> {
   let stderr = "";
   const drainOut = (async () => {
     for await (const chunk of proc.stdout) {
@@ -247,6 +271,97 @@ async function execStep(
 const CREDENTIALED_CLONE_SCRIPT =
   'IFS= read -r UAI_GIT_TOKEN && export UAI_GIT_TOKEN GIT_ASKPASS=/usr/local/bin/uai-git-askpass GIT_TERMINAL_PROMPT=0 && exec git clone -- "$1" "$2"';
 
+const WITHDRAWN = "the task's credentials were withdrawn while it was starting; start the task again";
+
+/** The task's user on a machine, and in sidecar mode. */
+const MACHINE_TASK_USER = "node";
+
+/**
+ * ADR-154 §12: a task on cloud credentials clones by exactly the route its
+ * lease names, with nothing of the machine's own and nothing the task could
+ * have put in its own login:
+ * - the clone starts as root, whose login is not the task's: a profile the
+ *   task wrote could otherwise read the token off stdin before anything
+ *   else, or put its own `env`, `git`, `GIT_EXEC_PATH` or `LD_PRELOAD` in
+ *   the clone's way;
+ * - in an environment rebuilt from nothing (`env -i`): a fixed PATH and no
+ *   home (so no .netrc, ~/.gitconfig or ~/.ssh/config), no global or system
+ *   git configuration;
+ * - then as the task's user (`setpriv`, when root), in a shell that reads no
+ *   profile. It alone reads the token from stdin, and runs git and ssh by
+ *   absolute path, with no credential helper and no agent.
+ */
+const LEASED_CLONE_ENV = [
+  "PATH=/usr/bin:/bin",
+  "HOME=/nonexistent",
+  "XDG_CONFIG_HOME=/nonexistent",
+  "LC_ALL=C",
+  "GIT_CONFIG_NOSYSTEM=1",
+  "GIT_CONFIG_GLOBAL=/dev/null",
+  "GIT_TERMINAL_PROMPT=0",
+] as const;
+/** Root drops to the task's user; anyone else (a non-root dev sidecar, whose
+ *  user is the task's) stays. The route's script arrives as $1, never on
+ *  stdin, which only it reads. */
+const LEASED_CLONE_DROP =
+  'if [ "$(/usr/bin/id -u)" = 0 ]; then ' +
+  `exec /usr/bin/setpriv --reuid=${MACHINE_TASK_USER} --regid=${MACHINE_TASK_USER} --init-groups -- /bin/sh -c "$1" clone "$2" "$3"; ` +
+  'fi; exec /bin/sh -c "$1" clone "$2" "$3"';
+const LEASED_GIT = "exec /usr/bin/git -c credential.helper= -c core.hooksPath=/dev/null";
+const LEASED_TOKEN_CLONE_SCRIPT =
+  'IFS= read -r UAI_GIT_TOKEN && export UAI_GIT_TOKEN GIT_ASKPASS=/usr/local/bin/uai-git-askpass && ' +
+  `${LEASED_GIT} clone -- "$1" "$2"`;
+const LEASED_SSH_CLONE_SCRIPT =
+  `export GIT_SSH_COMMAND="/usr/bin/ssh -F /dev/null -i ${TASK_SSH_KEY_PATH} -o IdentitiesOnly=yes -o IdentityAgent=none -o BatchMode=yes -o StrictHostKeyChecking=accept-new -o UserKnownHostsFile=/home/node/.ssh/known_hosts" && ` +
+  `${LEASED_GIT} -c url.git@github.com:.insteadOf=https://github.com/ clone -- "$1" "$2"`;
+const LEASED_ANONYMOUS_CLONE_SCRIPT = `${LEASED_GIT} clone -- "$1" "$2"`;
+
+/** The leased clone's command, run as root (see above). */
+export function leasedCloneArgv(script: string, url: string, destination: string): [string, ...string[]] {
+  return ["/usr/bin/env", "-i", ...LEASED_CLONE_ENV, "/bin/sh", "-c", LEASED_CLONE_DROP, "drop", script, url, destination];
+}
+
+/** How a task on cloud credentials clones: its lease's token, its SSH key,
+ *  or neither (it names neither). */
+interface LeasedCloneRoute {
+  ssh: boolean;
+  signal: AbortSignal;
+}
+
+const DENIED =
+  /repository not found|permission denied|access rights|could not read username|authentication failed|invalid username or password|returned error: 40[134]|HTTP 40[134]/i;
+
+/**
+ * A fresh clone by a leased route that failed: the start fails and the
+ * machine goes (unlike the legacy route's warning, ADR-121), saying which of
+ * the owner's credentials GitHub refused and what to do about it.
+ */
+function leasedCloneFailure(repoUrl: string, route: "token" | "ssh" | "none", stderr: string): AgentError {
+  const step = "clone";
+  if (isGithubRepoUrl(repoUrl) && DENIED.test(stderr)) {
+    if (route === "token") {
+      return new AgentError(
+        "GITHUB_TOKEN_ACCESS_DENIED",
+        `GitHub denied the task owner's GitHub sign-in access to ${repoUrl}. Confirm that the Uai GitHub App is installed on the owning account or organization, this repository is included in its grant, and the owner can read it. Then start the task again.`,
+        { step },
+      );
+    }
+    if (route === "ssh") {
+      return new AgentError(
+        "GITHUB_SSH_ACCESS_DENIED",
+        `GitHub denied the task owner's SSH key access to ${repoUrl}. Register that key with an account that can read the repository (and authorize it for SAML SSO when required), or connect GitHub in Settings. Then start the task again.`,
+        { step },
+      );
+    }
+    return new AgentError(
+      "GITHUB_CONNECTION_REQUIRED",
+      `The task owner has neither a GitHub sign-in nor an SSH key in Uai that can read ${repoUrl}. Connect GitHub in Settings, then start the task again.`,
+      { step },
+    );
+  }
+  return new AgentError("CLONE_FAILED", `could not clone ${repoUrl}: ${stderr || "clone failed"}`, { step });
+}
+
 type ProjectEnvSchemaObservation = NonNullable<TaskUpResult["envSchemas"]>[number];
 
 /** What a project's clone step did: cloned it now, found the task's own
@@ -263,6 +378,8 @@ async function cloneProject(
   taskBranch: string,
   owner: { name?: string; email?: string },
   token: string | null,
+  /** A task on cloud credentials: its exact route, and its withdrawal. */
+  leased?: LeasedCloneRoute,
 ): Promise<CloneOutcome> {
   const url = machineCloneUrl(project.repoUrl);
   const useToken = token !== null && isGithubRepoUrl(project.repoUrl);
@@ -275,19 +392,37 @@ async function cloneProject(
     GIT_STEP_TIMEOUT_MS,
   );
   if (already.exitCode === 0) return { clone: "existing", warning: null };
+  // Withdrawn while the probe ran: the clone never starts.
+  if (leased?.signal.aborted) throw new Error(WITHDRAWN);
 
-  const clone = useToken
+  const route = useToken ? "token" : leased?.ssh && isGithubRepoUrl(project.repoUrl) ? "ssh" : "none";
+  const clone = leased
     ? await execWithStdin(
         handle,
-        ["/bin/sh", "-c", CREDENTIALED_CLONE_SCRIPT, "clone", url, destination],
-        `${token}\n`,
+        leasedCloneArgv(
+          route === "token" ? LEASED_TOKEN_CLONE_SCRIPT : route === "ssh" ? LEASED_SSH_CLONE_SCRIPT : LEASED_ANONYMOUS_CLONE_SCRIPT,
+          url,
+          destination,
+        ),
+        useToken ? `${token}\n` : "",
         CLONE_TIMEOUT_MS,
+        leased.signal,
+        "root",
       )
-    : await execStep(
-        handle,
-        ["git", "clone", "--", url, destination],
-        CLONE_TIMEOUT_MS,
-      );
+    : useToken
+      ? await execWithStdin(
+          handle,
+          ["/bin/sh", "-c", CREDENTIALED_CLONE_SCRIPT, "clone", url, destination],
+          `${token}\n`,
+          CLONE_TIMEOUT_MS,
+        )
+      : await execStep(
+          handle,
+          ["git", "clone", "--", url, destination],
+          CLONE_TIMEOUT_MS,
+        );
+  if (leased?.signal.aborted) throw new Error(WITHDRAWN);
+  if (clone.exitCode !== 0 && leased) throw leasedCloneFailure(project.repoUrl, route, clone.stderr);
   if (clone.exitCode !== 0) {
     // The commonest failure by far is an ANONYMOUS clone of a private GitHub
     // repo because this host has no GitHub credential for the task owner —
@@ -629,6 +764,122 @@ export async function ensureCodeServer(
   }
 }
 
+/** How long a start that is not one waits for the stages it left running. */
+const ABANDON_JOIN_MS = 15_000;
+
+/** Until every one of `work` is settled, or `ms` has passed. */
+async function joinBounded(work: readonly Promise<unknown>[], ms: number): Promise<void> {
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  await Promise.race([
+    Promise.allSettled(work),
+    new Promise<void>((resolve) => {
+      timer = setTimeout(resolve, ms);
+      timer.unref?.();
+    }),
+  ]);
+  if (timer) clearTimeout(timer);
+}
+
+/**
+ * A start's own view of its machine: every call through it, and every write
+ * to a process started through it, is refused once `over()` holds. Work the
+ * start left behind therefore never reaches the machine again, nor a
+ * replacement that reuses its name.
+ */
+function fencedHandle(handle: TaskEnvironmentHandle<unknown>, over: () => boolean): TaskEnvironmentHandle<unknown> {
+  const admit = (): void => {
+    if (over()) throw new Error(WITHDRAWN);
+  };
+  // Checked again by the provider at its last moment, after anything it
+  // awaits first (a machine looks up its address): a call admitted before
+  // the start ended never starts after it.
+  const lastly = (inner?: () => void) => (): void => {
+    admit();
+    inner?.();
+  };
+  const fenced = (proc: TaskEnvironmentProcess): TaskEnvironmentProcess => ({
+    stdout: proc.stdout,
+    stderr: proc.stderr,
+    completion: proc.completion,
+    write: async (chunk) => {
+      admit();
+      await proc.write(chunk);
+    },
+    closeInput: () => proc.closeInput(),
+    terminate: (signal) => proc.terminate(signal),
+  });
+  return {
+    descriptor: handle.descriptor,
+    durableIdentity: handle.durableIdentity,
+    ...(handle.anchors === undefined ? {} : { anchors: handle.anchors }),
+    ...(handle.credentialDelivery === undefined ? {} : { credentialDelivery: handle.credentialDelivery }),
+    readWorkspaceFile: async (path, options) => {
+      admit();
+      return handle.readWorkspaceFile(path, { ...options, admit: lastly(options?.admit) });
+    },
+    writeWorkspaceFile: async (path, bytes, options) => {
+      admit();
+      await handle.writeWorkspaceFile(path, bytes, { ...options, admit: lastly(options?.admit) });
+    },
+    exec: async (request) => {
+      admit();
+      return handle.exec({ ...request, admit: lastly(request.admit) });
+    },
+    spawn: async (request) => {
+      admit();
+      return fenced(await handle.spawn({ ...request, admit: lastly(request.admit) }));
+    },
+    spawnSession: async (request) => {
+      admit();
+      return fenced(await handle.spawnSession({ ...request, admit: lastly(request.admit) }));
+    },
+    launchDetachedSession: async (request) => {
+      admit();
+      return handle.launchDetachedSession({ ...request, admit: lastly(request.admit) });
+    },
+    copy: async (request) => {
+      admit();
+      await handle.copy({ ...request, admit: lastly(request.admit) });
+    },
+    ports: async () => {
+      admit();
+      return handle.ports();
+    },
+    status: async () => {
+      admit();
+      return handle.status();
+    },
+    recover: async (context) => {
+      admit();
+      return handle.recover(context);
+    },
+    stop: async () => {
+      admit();
+      await handle.stop();
+    },
+    teardown: async () => {
+      admit();
+      await handle.teardown();
+    },
+    ...(handle.inspectRoute
+      ? {
+          inspectRoute: async () => {
+            admit();
+            return handle.inspectRoute!();
+          },
+        }
+      : {}),
+    ...(handle.gatewayTunnelSshArgs
+      ? {
+          gatewayTunnelSshArgs: async (machinePort: number, hostPort: number, options?: TaskEnvironmentCallOptions) => {
+            admit();
+            return handle.gatewayTunnelSshArgs!(machinePort, hostPort, { ...options, admit: lastly(options?.admit) });
+          },
+        }
+      : {}),
+  };
+}
+
 /** The identity the host records for the task's runtime: the machine id for
  * a machine over ssh (what recovery and orphan sweeps key on), the handle's
  * durable identity for anything else (sidecar mode: `self:<task>`). */
@@ -649,8 +900,10 @@ function withTaskDownResult(
   return {
     descriptor: handle.descriptor,
     durableIdentity: handle.durableIdentity,
-    readWorkspaceFile: (path) => handle.readWorkspaceFile(path),
-    writeWorkspaceFile: (path, bytes) => handle.writeWorkspaceFile(path, bytes),
+    ...(handle.anchors === undefined ? {} : { anchors: handle.anchors }),
+    ...(handle.credentialDelivery === undefined ? {} : { credentialDelivery: handle.credentialDelivery }),
+    readWorkspaceFile: (path, options) => handle.readWorkspaceFile(path, options),
+    writeWorkspaceFile: (path, bytes, options) => handle.writeWorkspaceFile(path, bytes, options),
     exec: (request) => handle.exec(request),
     spawn: (request) => handle.spawn(request),
     spawnSession: (request) => handle.spawnSession(request),
@@ -669,8 +922,8 @@ function withTaskDownResult(
       : {}),
     ...(handle.gatewayTunnelSshArgs
       ? {
-          gatewayTunnelSshArgs: (machinePort: number, hostPort: number) =>
-            handle.gatewayTunnelSshArgs!(machinePort, hostPort),
+          gatewayTunnelSshArgs: (machinePort: number, hostPort: number, options?: TaskEnvironmentCallOptions) =>
+            handle.gatewayTunnelSshArgs!(machinePort, hostPort, options),
         }
       : {}),
   };
@@ -694,7 +947,36 @@ export function createMachineHostTaskEnvironmentProvider(
     ): Promise<TaskEnvironmentProvisioned<TaskUpResult, TaskDownResult>> {
       const { input } = request;
       const envMode = request.envMode ?? "loader";
-      const provisioned = await deps.environment.provision({
+      // ADR-154 §12: a task on cloud credentials holds its grant for the
+      // whole start; withdrawn (its gate closed, a cleanup reached it), the
+      // start stops wherever it is, its clone included, and the machine goes.
+      const leased = request.credentials.leased;
+      assertLeasedTaskUp(leased, input.task);
+      const clone = leased?.clone;
+      const withdrawal = (): Error => new Error(WITHDRAWN);
+      if (clone?.signal.aborted) throw withdrawal();
+      const untilWithdrawn = <T>(work: Promise<T>): Promise<T> => {
+        if (!clone) return work;
+        return new Promise<T>((resolve, reject) => {
+          const onAbort = (): void => reject(withdrawal());
+          if (clone.signal.aborted) {
+            onAbort();
+            return;
+          }
+          clone.signal.addEventListener("abort", onAbort, { once: true });
+          work.then(
+            (value) => {
+              clone.signal.removeEventListener("abort", onAbort);
+              resolve(value);
+            },
+            (error: unknown) => {
+              clone.signal.removeEventListener("abort", onAbort);
+              reject(error);
+            },
+          );
+        });
+      };
+      const provisioning = deps.environment.provision({
         taskId: request.taskId,
         input: {
           image: deps.machineImage(),
@@ -706,21 +988,75 @@ export function createMachineHostTaskEnvironmentProvider(
         envMode,
         onPrepared: request.onPrepared,
       });
+      let provisioned: Awaited<typeof provisioning>;
+      try {
+        provisioned = await untilWithdrawn(provisioning);
+      } catch (error) {
+        if (clone?.signal.aborted) {
+          // Withdrawn while the machine came up: the start returns only once
+          // that is over and the machine is gone again (the provider's own
+          // timeouts bound the wait). A teardown left for later could take a
+          // replacement, which reuses the task's machine name.
+          const late = await provisioning.catch(() => null);
+          if (late) await late.handle.teardown().catch(() => {});
+        }
+        throw error;
+      }
       const handle = provisioned.handle;
       const workspacePath = handle.descriptor.workspacePath;
       const warnings: string[] = [];
       const clones: Array<{ projectId: string; destination: string; clone: CloneOutcome["clone"] }> = [];
+      // The start's own view of the machine: once the start is withdrawn or
+      // failed, every call through it is refused, so work it began and left
+      // behind never reaches the machine again, nor the replacement that
+      // reuses its name: no exec, write, secret or teardown.
+      let over = false;
+      const own = fencedHandle(handle, () => over || clone?.signal.aborted === true);
+      // Every later stage races the withdrawal, through the start's last
+      // step: withdrawn, the start stops wherever it is. What it began is
+      // fenced off, the machine goes, and the stages still running get a
+      // bounded chance to end before the start returns.
+      const begun: Array<Promise<unknown>> = [];
+      const stage = <T>(work: Promise<T>): Promise<T> => {
+        begun.push(work);
+        work.catch(() => {});
+        return untilWithdrawn(work);
+      };
+      let abandoning: Promise<void> | null = null;
+      const abandon = (): Promise<void> => {
+        over = true;
+        abandoning ??= (async () => {
+          await handle.teardown().catch(() => {});
+          await joinBounded(begun, deps.abandonJoinMs ?? ABANDON_JOIN_MS);
+        })();
+        return abandoning;
+      };
 
       try {
+        if (clone?.signal.aborted) throw withdrawal();
+        // ADR-154 §12: the runtime exists and nothing in it has run yet: the
+        // runner's writes (the owner's GitHub configuration and SSH key,
+        // recorded for cleanup) come first, so the clones below authenticate
+        // with them, over SSH too.
+        if (leased) {
+          const writes = leased.runtimeReady(own, leased.clone.signal);
+          try {
+            await untilWithdrawn(writes);
+          } catch (error) {
+            // Joined before anything else happens: nothing still writes into
+            // the machine once the start has stopped.
+            over = true;
+            await writes.catch(() => {});
+            throw error;
+          }
+        }
         if (envMode === "loader") {
-          await installMachineProjectEnvLoader(handle);
+          await stage(installMachineProjectEnvLoader(own));
           // ADR-153, on a machine's own task (the sidecar's): the proxy's CA
           // and pins before anything in the task loads its env. Never fails
           // the start; its proxied keys stay withheld until they are in.
-          const proxyWarning = await reconcileSidecarTaskProxy(
-            handle,
-            activeSecretsProxy()?.runtime ?? null,
-            { start: true },
+          const proxyWarning = await stage(
+            reconcileSidecarTaskProxy(own, activeSecretsProxy()?.runtime ?? null, { start: true }),
           );
           if (proxyWarning !== null) console.warn(`[machine] task ${request.taskId}: ${proxyWarning}`);
         }
@@ -730,95 +1066,122 @@ export function createMachineHostTaskEnvironmentProvider(
         const wantsGithub = projects.some((project) =>
           isGithubRepoUrl(project.repoUrl),
         );
-        const token = wantsGithub
-          ? await deps.githubToken(input.task.ownerUserId)
-          : null;
+        // ADR-154 §12: a task on cloud credentials clones with the token its
+        // lease holds for this start, never the runner's own store.
+        const token = !wantsGithub
+          ? null
+          : clone
+            ? clone.github && { accessToken: clone.github.token }
+            : await deps.githubToken(input.task.ownerUserId);
         for (const project of projects) {
+          if (clone?.signal.aborted) throw withdrawal();
           const destination = `${workspacePath}/${projectDirectoryName(project.slug)}`;
-          const outcome = await cloneProject(
-            handle,
-            destination,
-            project,
-            input.task.branch,
-            { name: input.ownerName, email: input.ownerEmail },
-            token?.accessToken ?? null,
+          const outcome = await untilWithdrawn(
+            cloneProject(
+              own,
+              destination,
+              project,
+              input.task.branch,
+              { name: input.ownerName, email: input.ownerEmail },
+              token?.accessToken ?? null,
+              clone ? { ssh: clone.ssh !== null, signal: clone.signal } : undefined,
+            ),
           );
           clones.push({ projectId: project.id, destination, clone: outcome.clone });
           if (outcome.warning) warnings.push(outcome.warning);
         }
+        if (clone?.signal.aborted) throw withdrawal();
       } catch (error) {
         // Provisioning-infrastructure failures (ssh died, unsafe slug) tear
-        // the machine down rather than stranding an orphan; per-repo problems
-        // were already converted to warnings above and do not land here.
-        await handle.teardown().catch(() => {});
+        // the machine down rather than stranding an orphan, and so does a
+        // leased clone that failed; a legacy route's per-repo problems were
+        // already converted to warnings above and do not land here.
+        await abandon();
         throw error;
       }
-      // ADR-153 §4: right after the clones, before shared files, the
-      // forwarder, the editor or any agent.
-      const envSchemas = await captureMachineEnvSchemas(request.taskId, handle, clones);
-
-      // ADR-062 shared files: point-in-time copy (see copySharedFiles).
-      const sharedWarning = await (deps.sharedFiles ?? copySharedFiles)(handle, workspacePath, {
-        ...(input.task.ownerOrgId ? { ownerOrgId: input.task.ownerOrgId } : {}),
-        ownerUserId: input.task.ownerUserId,
-        ...(input.task.sharedFiles ? { sharedFiles: input.task.sharedFiles } : {}),
-      }).catch((error: unknown) => {
-        console.warn(
-          `[machine] task ${request.taskId}: shared files copy failed: ${
-            error instanceof Error ? error.message : String(error)
-          }`,
+      let envSchemas: ProjectEnvSchemaObservation[];
+      try {
+        // ADR-153 §4: right after the clones, before shared files, the
+        // forwarder, the editor or any agent.
+        envSchemas = await stage(captureMachineEnvSchemas(request.taskId, own, clones));
+
+        // ADR-062 shared files: point-in-time copy (see copySharedFiles).
+        const sharedWarning = await stage(
+          (deps.sharedFiles ?? copySharedFiles)(own, workspacePath, {
+            ...(input.task.ownerOrgId ? { ownerOrgId: input.task.ownerOrgId } : {}),
+            ownerUserId: input.task.ownerUserId,
+            ...(input.task.sharedFiles ? { sharedFiles: input.task.sharedFiles } : {}),
+          }).catch((error: unknown) => {
+            console.warn(
+              `[machine] task ${request.taskId}: shared files copy failed: ${
+                error instanceof Error ? error.message : String(error)
+              }`,
+            );
+            return null;
+          }),
         );
-        return null;
-      });
-      if (sharedWarning) warnings.push(sharedWarning);
-
-      // Codex default-slot credentials: the legacy delivery paths are all
-      // docker grammar; machines get theirs over the transport. Best-effort
-      // — a failed inject degrades codex agents, never the task.
-      if (input.task.agents.some((agent) => agent.kind === "codex")) {
-        await injectCodexIntoMachine(handle).catch((error: unknown) => {
-          console.warn(
-            `[machine] task ${request.taskId}: codex inject failed: ${
-              error instanceof Error ? error.message : String(error)
-            }`,
-          );
-        });
-      }
+        if (sharedWarning) warnings.push(sharedWarning);
 
-      if (envMode === "loader") {
-        try {
-          await startMachineTaskForwarder(
-            request.taskId,
-            handle,
-            request.credentials,
-            deps.ensureGatewayTunnel ?? ensureMachineGatewayTunnelReady,
-          );
-        } catch (error) {
-          // Unlike editor/auth conveniences, the loader is the only project
-          // env delivery path. A task without it must not start and silently
-          // hand consumers an incomplete or legacy environment.
-          stopMachineGatewayTunnel(request.taskId);
-          await handle.teardown().catch(() => {});
-          throw error;
+        // Codex default-slot credentials: the legacy delivery paths are all
+        // docker grammar; machines get theirs over the transport. Best-effort
+        // — a failed inject degrades codex agents, never the task. A task on
+        // cloud credentials gets its accounts from its lease, never the
+        // runner's own (ADR-154 §6).
+        if (!clone && input.task.agents.some((agent) => agent.kind === "codex")) {
+          await injectCodexIntoMachine(own).catch((error: unknown) => {
+            console.warn(
+              `[machine] task ${request.taskId}: codex inject failed: ${
+                error instanceof Error ? error.message : String(error)
+              }`,
+            );
+          });
         }
-      }
 
-      // Editor pane: code-server on the machine (same flags as uai-init's
-      // container launch), idempotent across provision re-runs and resume.
-      // Best-effort — a missing binary degrades the Editor tab, never the task.
-      await ensureCodeServer(
-        handle,
-        workspacePath,
-        input.task.previewEnv?.UAI_EDITOR_THEME,
-        envMode,
-      ).catch((error: unknown) => {
-        console.warn(
-          `[machine] task ${request.taskId}: code-server launch failed: ${
-            error instanceof Error ? error.message : String(error)
-          }`,
+        if (envMode === "loader") {
+          try {
+            await stage(
+              startMachineTaskForwarder(
+                request.taskId,
+                own,
+                request.credentials,
+                deps.ensureGatewayTunnel ?? ensureMachineGatewayTunnelReady,
+              ),
+            );
+          } catch (error) {
+            // Unlike editor/auth conveniences, the loader is the only project
+            // env delivery path. A task without it must not start and silently
+            // hand consumers an incomplete or legacy environment.
+            stopMachineGatewayTunnel(request.taskId);
+            await abandon();
+            throw error;
+          }
+        }
+
+        // Editor pane: code-server on the machine (same flags as uai-init's
+        // container launch), idempotent across provision re-runs and resume.
+        // Best-effort — a missing binary degrades the Editor tab, never the task.
+        await stage(
+          ensureCodeServer(own, workspacePath, input.task.previewEnv?.UAI_EDITOR_THEME, envMode).catch(
+            (error: unknown) => {
+              console.warn(
+                `[machine] task ${request.taskId}: code-server launch failed: ${
+                  error instanceof Error ? error.message : String(error)
+                }`,
+              );
+            },
+          ),
         );
-      });
 
+        // Withdrawn while the rest came up: the start is not one.
+        if (clone?.signal.aborted) throw withdrawal();
+      } catch (error) {
+        if (clone?.signal.aborted) {
+          stopMachineGatewayTunnel(request.taskId);
+          await abandon();
+          throw withdrawal();
+        }
+        throw error;
+      }
       return {
         handle: withTaskDownResult(handle),
         result: {