@runuai/host 0.9.150 → 0.9.151

package/lib/task-environment/machine.ts

@@ -24,6 +24,15 @@ import type {
 } from "../machine-provider";
 import { machineEnvironmentSshArgs } from "../machine-exec";
 import { applyProjectEnvProfile } from "../runtime-authority";
+import { rootAnchoredRequest } from "./anchor";
+import {
+  BASELINE_PATH,
+  ETC_ENVIRONMENT_PATH,
+  parseEtcEnvironment,
+  withoutEngineCredentials,
+  withoutLaunchSecrets,
+} from "./machine-environment";
+import { NotARegularFileError } from "./workspace-files";
 import { capturedCliExec, streamingCliExec } from "./docker";
 import {
   assertTaskEnvironmentExecRequest,
@@ -31,6 +40,9 @@ import {
   refusePrivilegedExec,
   assertTaskEnvironmentSessionRequest,
   assertWorkspaceScopedPath,
+  type TaskEnvironmentCallOptions,
+  type TaskEnvironmentReadOptions,
+  WORKSPACE_READ_MAX_BYTES,
   type TaskEnvironmentCopyRequest,
   type TaskEnvironmentDescriptor,
   type TaskEnvironmentDetachedSessionRequest,
@@ -69,6 +81,19 @@ export interface MachineTaskEnvironmentLocatorValue {
   sshUser: string;
 }
 
+/**
+ * A workspace read on a machine, as the task user: argv $1 the path, $2 the
+ * most bytes it takes, $3 "end" for the file's last bytes. Absence and
+ * error are different facts: 44 marks a MISSING file so a transport or
+ * permission failure can never masquerade as one; 45 a path that is not a
+ * regular file (a link in its place, a FIFO, a device), never read. A file
+ * swapped in after that check is bounded by the read's own timeout.
+ */
+export const MACHINE_WORKSPACE_READ_SCRIPT =
+  `if [ ! -e "$1" ] && [ ! -L "$1" ]; then exit 44; fi; ` +
+  `if [ -L "$1" ] || [ ! -f "$1" ]; then exit 45; fi; ` +
+  `if [ "$3" = end ]; then exec tail -c "$2" "$1"; else exec head -c "$2" "$1"; fi`;
+
 export interface MachineTaskInput {
   image: string;
   cpus: number;
@@ -180,11 +205,18 @@ function validateMachineLocatorValue(
 class MachineTaskEnvironmentHandle implements TaskEnvironmentHandle {
   readonly descriptor: TaskEnvironmentDescriptor;
   readonly durableIdentity: string;
+  /** ADR-154 §6: anchored requests start under the engine supervisor. */
+  readonly anchors = true;
+  /** ADR-154 §6: a request's environment rides the ssh command line, so a
+   *  leased launch's engine credentials travel in its admission. */
+  readonly credentialDelivery = "admission";
   readonly #value: MachineTaskEnvironmentLocatorValue;
   readonly #deps: Required<
     Pick<MachineTaskEnvironmentDeps, "machines" | "spawn" | "readyTimeoutMs">
   > &
     MachineTaskEnvironmentDeps;
+  /** The machine's own /etc/environment, read once (see #anchoredBaseline). */
+  #machineWide: Promise<Record<string, string>> | null = null;
 
   constructor(
     locator: TaskEnvironmentLocator,
@@ -248,6 +280,51 @@ class MachineTaskEnvironmentHandle implements TaskEnvironmentHandle {
     return info;
   }
 
+  /**
+   * ADR-154 §6: an anchored launch starts from nothing of its ssh session's
+   * environment (sshd's, PAM's, the login's: an older image may leave an
+   * owner's sign-in there), only from what it names: a PATH, the machine's
+   * /etc/environment as pam_env would apply it (never an engine's
+   * credential, nor an agent's task token), and its own env. Anything else
+   * is unchanged.
+   */
+  async #anchoredBaseline<
+    T extends { anchor?: unknown; env?: Readonly<Record<string, string>> },
+  >(request: T): Promise<T & { clean?: true }> {
+    if (!request.anchor) return request;
+    const machineWide = await this.#machineWideEnvironment();
+    return {
+      ...request,
+      // It rides the command line: no secret of the machine's on it.
+      env: { PATH: BASELINE_PATH, ...withoutLaunchSecrets(machineWide), ...request.env },
+      clean: true,
+    };
+  }
+
+  /** The machine's /etc/environment without any engine's credential, read
+   *  once over ssh (absent: empty); read again after a failed read. */
+  #machineWideEnvironment(): Promise<Record<string, string>> {
+    if (this.#machineWide) return this.#machineWide;
+    const reading = (async () => {
+      const result = await this.exec({
+        argv: ["/bin/cat", ETC_ENVIRONMENT_PATH],
+        projectEnvProfile: "maintenance",
+        timeoutMs: 30_000,
+        maxOutputBytes: 64 * 1024,
+      });
+      if (result.exitCode === 1 && result.stdout.length === 0) return {};
+      if (result.exitCode !== 0 || result.stdoutTruncated) {
+        throw new Error(`machine ${this.#value.machineId}'s environment could not be read`);
+      }
+      return withoutEngineCredentials(parseEtcEnvironment(Buffer.from(result.stdout).toString("utf8")));
+    })();
+    this.#machineWide = reading;
+    reading.catch(() => {
+      if (this.#machineWide === reading) this.#machineWide = null;
+    });
+    return reading;
+  }
+
   #maintenanceRequest<
     T extends {
       argv: readonly [string, ...string[]];
@@ -266,9 +343,11 @@ class MachineTaskEnvironmentHandle implements TaskEnvironmentHandle {
     );
   }
 
-  async readWorkspaceFile(path: string): Promise<Uint8Array | null> {
+  async readWorkspaceFile(path: string, options?: TaskEnvironmentReadOptions): Promise<Uint8Array | null> {
     assertWorkspaceScopedPath(this.descriptor, path);
+    const maxBytes = Math.max(0, Math.floor(options?.maxBytes ?? WORKSPACE_READ_MAX_BYTES));
     const target = await this.#target();
+    options?.admit?.();
     const result = await capturedCliExec(
       this.#deps.spawn,
       "ssh",
@@ -278,11 +357,11 @@ class MachineTaskEnvironmentHandle implements TaskEnvironmentHandle {
           argv: [
             "/bin/sh",
             "-c",
-            // Absence and error are different facts: 44 marks a MISSING file
-            // so a transport/permission failure can never masquerade as one.
-            `if [ -e "$1" ]; then exec cat "$1"; else exit 44; fi`,
+            MACHINE_WORKSPACE_READ_SCRIPT,
             "read",
             path,
+            String(maxBytes),
+            options?.from === "end" ? "end" : "start",
           ],
         }),
         "interactive",
@@ -295,6 +374,7 @@ class MachineTaskEnvironmentHandle implements TaskEnvironmentHandle {
       },
     );
     if (result.exitCode === 44) return null;
+    if (result.exitCode === 45) throw new NotARegularFileError();
     if (result.exitCode !== 0) {
       throw new Error(
         `machine workspace read failed: ${Buffer.from(result.stderr).toString("utf8").trim()}`,
@@ -303,9 +383,10 @@ class MachineTaskEnvironmentHandle implements TaskEnvironmentHandle {
     return result.stdout;
   }
 
-  async writeWorkspaceFile(path: string, bytes: Uint8Array): Promise<void> {
+  async writeWorkspaceFile(path: string, bytes: Uint8Array, options?: TaskEnvironmentCallOptions): Promise<void> {
     assertWorkspaceScopedPath(this.descriptor, path);
     const target = await this.#target();
+    options?.admit?.();
     const result = await capturedCliExec(
       this.#deps.spawn,
       "ssh",
@@ -343,7 +424,7 @@ class MachineTaskEnvironmentHandle implements TaskEnvironmentHandle {
     assertTaskEnvironmentExecRequest(request);
     refusePrivilegedExec(request);
     const profiled = applyProjectEnvProfile(
-      request,
+      rootAnchoredRequest(await this.#anchoredBaseline(request)),
       this.descriptor.envMode ?? "baked",
       "/bin/bash",
     );
@@ -362,11 +443,12 @@ class MachineTaskEnvironmentHandle implements TaskEnvironmentHandle {
   ): Promise<TaskEnvironmentProcess> {
     assertTaskEnvironmentProcessRequest(request);
     const profiled = applyProjectEnvProfile(
-      request,
+      rootAnchoredRequest(await this.#anchoredBaseline(request)),
       this.descriptor.envMode ?? "baked",
       "/bin/bash",
     );
     const target = await this.#target();
+    request.admit?.();
     return streamingCliExec(
       this.#deps.spawn,
       "ssh",
@@ -381,11 +463,12 @@ class MachineTaskEnvironmentHandle implements TaskEnvironmentHandle {
     assertTaskEnvironmentSessionRequest(request);
     // Sessions default to the workspace the way container images default to
     // WORKDIR /workspace — an agent CLI must start in the task's world.
-    const sessionRequest = applyProjectEnvProfile({
+    const sessionRequest = applyProjectEnvProfile(rootAnchoredRequest(await this.#anchoredBaseline({
       ...request,
       cwd: request.cwd ?? this.#value.workspacePath,
-    }, this.descriptor.envMode ?? "baked", "/bin/bash");
+    })), this.descriptor.envMode ?? "baked", "/bin/bash");
     const target = await this.#target();
+    request.admit?.();
     return streamingCliExec(
       this.#deps.spawn,
       "ssh",
@@ -398,11 +481,12 @@ class MachineTaskEnvironmentHandle implements TaskEnvironmentHandle {
     request: TaskEnvironmentDetachedSessionRequest,
   ): Promise<TaskEnvironmentExecResult> {
     assertTaskEnvironmentSessionRequest(request);
-    const sessionRequest = applyProjectEnvProfile({
+    const sessionRequest = applyProjectEnvProfile(rootAnchoredRequest(await this.#anchoredBaseline({
       ...request,
       cwd: request.cwd ?? this.#value.workspacePath,
-    }, this.descriptor.envMode ?? "baked", "/bin/bash");
+    })), this.descriptor.envMode ?? "baked", "/bin/bash");
     const target = await this.#target();
+    request.admit?.();
     return capturedCliExec(
       this.#deps.spawn,
       "ssh",
@@ -435,6 +519,7 @@ class MachineTaskEnvironmentHandle implements TaskEnvironmentHandle {
           ["-C", request.source, "-cf", "-", "."],
           { encoding: "buffer", maxBuffer: 256 * 1024 * 1024 },
         );
+        request.admit?.();
         const extract = await capturedCliExec(
           this.#deps.spawn,
           "ssh",
@@ -467,6 +552,7 @@ class MachineTaskEnvironmentHandle implements TaskEnvironmentHandle {
         return;
       }
       const bytes = readFileSync(request.source);
+      request.admit?.();
       const result = await capturedCliExec(
         this.#deps.spawn,
         "ssh",
@@ -498,6 +584,7 @@ class MachineTaskEnvironmentHandle implements TaskEnvironmentHandle {
       }
       return;
     }
+    request.admit?.();
     const result = await capturedCliExec(
       this.#deps.spawn,
       "ssh",
@@ -552,8 +639,10 @@ class MachineTaskEnvironmentHandle implements TaskEnvironmentHandle {
   async gatewayTunnelSshArgs(
     machinePort: number,
     hostPort: number,
+    options?: TaskEnvironmentCallOptions,
   ): Promise<string[]> {
     const target = await this.#target();
+    options?.admit?.();
     return [
       "-o", "BatchMode=yes",
       "-o", "StrictHostKeyChecking=accept-new",
@@ -594,6 +683,7 @@ class MachineTaskEnvironmentHandle implements TaskEnvironmentHandle {
           state: "stopped",
           instances: [this.#value.machineId],
           workspacePresent: true,
+          ...(info.frozen ? { frozen: true as const } : {}),
         };
       case "absent":
         return { state: "absent", instances: [], workspacePresent: false };

package/lib/task-environment/self.ts

@@ -16,7 +16,6 @@
  */
 import { spawn as nodeSpawn } from "node:child_process";
 import { existsSync, readFileSync } from "node:fs";
-import { readFile } from "node:fs/promises";
 
 import { buildRemoteCommand } from "../machine-exec";
 import {
@@ -31,6 +30,8 @@ import {
   refusePrivilegedExec,
   assertTaskEnvironmentSessionRequest,
   assertWorkspaceScopedPath,
+  type TaskEnvironmentCallOptions,
+  type TaskEnvironmentReadOptions,
   type TaskEnvironmentCopyRequest,
   type TaskEnvironmentDescriptor,
   type TaskEnvironmentDetachedSessionRequest,
@@ -51,9 +52,17 @@ import {
   type TaskEnvironmentStatus,
   TASK_ENVIRONMENT_LOCATOR_SCHEMA_VERSION,
 } from "./types";
+import {
+  BASELINE_PATH,
+  ETC_ENVIRONMENT_PATH,
+  parseEtcEnvironment,
+  withoutEngineCredentials,
+  withoutLaunchSecrets,
+} from "./machine-environment";
 import { SELF_TASK_ENVIRONMENT_PROVIDER, SELF_TASK_USER, TASK_HOSTS_VIEW_PATH } from "./self-identity";
+import { readBoundedFile, workspacePathParts } from "./workspace-files";
 
-export { SELF_TASK_ENVIRONMENT_PROVIDER, SELF_TASK_USER, TASK_HOSTS_VIEW_PATH };
+export { ETC_ENVIRONMENT_PATH, parseEtcEnvironment, SELF_TASK_ENVIRONMENT_PROVIDER, SELF_TASK_USER, TASK_HOSTS_VIEW_PATH };
 
 /**
  * Binds the view, then runs the rest of its argv. With no view yet (nothing
@@ -91,37 +100,19 @@ export interface SelfTaskEnvironmentDeps {
   /** The machine-wide environment every request runs under (beneath its own
    * `env`). Defaults to /etc/environment — see `readEtcEnvironment`. */
   etcEnvironment?: () => Readonly<Record<string, string>>;
+  /** Tests only: start an anchored launch without the drop to the task
+   * user, so the supervisor and what it carries are the test user's own. No
+   * isolation boundary: never a runner's (ADR-154 §6). */
+  anchorWithoutIsolationForTests?: boolean;
 }
 
-/**
- * /etc/environment, as pam_env reads it: `KEY=value` lines, optional
- * `export`, optional single or double quotes, `#` comments. The machine
- * provider gets these for free — sshd applies pam_env to every session — but
- * a local `setpriv --reset-env … sh -lc` sees neither pam nor the file, so
+/*
+ * /etc/environment (parseEtcEnvironment). The machine provider gets it for
+ * free — sshd applies pam_env to every session — but a local
+ * `setpriv --reset-env … sh -lc` sees neither pam nor the file, so
  * `PLAYWRIGHT_BROWSERS_PATH` from the payload image never reached an agent
  * on the sidecar and every task re-downloaded Chromium (2026-09-10, smoke 6).
  */
-export function parseEtcEnvironment(text: string): Record<string, string> {
-  const out: Record<string, string> = {};
-  for (const raw of text.split("\n")) {
-    const line = raw.trim();
-    if (!line || line.startsWith("#")) continue;
-    const match = /^(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)=(.*)$/.exec(line);
-    if (!match) continue;
-    let value = match[2]!.trim();
-    if (
-      value.length >= 2 &&
-      ((value.startsWith('"') && value.endsWith('"')) ||
-        (value.startsWith("'") && value.endsWith("'")))
-    ) {
-      value = value.slice(1, -1);
-    }
-    out[match[1]!] = value;
-  }
-  return out;
-}
-
-export const ETC_ENVIRONMENT_PATH = "/etc/environment";
 let etcEnvironmentCache: Record<string, string> | null = null;
 /** The parsed /etc/environment, read once per process (the image writes it
  * at bake time; nothing edits it on a task machine). Empty when absent. */
@@ -174,7 +165,9 @@ export function parseSelfTaskEnvironmentLocator(
  * line the machine provider ships over ssh, run through setpriv when this
  * process is root and the request wants a task user. Values ride argv here
  * exactly as they ride the ssh command line on a machine task — the machine
- * is one task's trust domain (machine-exec.ts).
+ * is one task's trust domain (machine-exec.ts) — except a leased engine's
+ * credentials, which its admission carries to the injector this line runs
+ * after its drop (ADR-154 §6).
  */
 export function selfCommand(
   request: {
@@ -183,6 +176,7 @@ export function selfCommand(
     user?: string;
     inheritEnv?: readonly string[];
     env?: Readonly<Record<string, string>>;
+    anchor?: { readonly prefix: readonly [string, ...string[]]; readonly injector?: readonly string[] };
   },
   mode: "interactive" | "detached",
   privileged: boolean,
@@ -200,6 +194,15 @@ export function selfCommand(
           args: [...outerProfileEnv, "/bin/sh", "-lc", line],
         };
   const user = request.user ?? SELF_TASK_USER;
+  // ADR-154 §6: an anchored process starts under the engine supervisor, as
+  // root inside the task's view, which then runs the drop to the task user
+  // itself ("-": setpriv drops it). What the launch carries is read by the
+  // injector right after that drop, into the environment setpriv reset.
+  const anchor = request.anchor ? [...request.anchor.prefix, "-", "--"] : [];
+  const injector = request.anchor?.injector ?? [];
+  if (request.anchor && user === "root") {
+    throw new Error("an anchored process runs as a task user, never as root");
+  }
   if (privileged && user !== "root") {
     return {
       command: "/usr/bin/unshare",
@@ -213,27 +216,48 @@ export function selfCommand(
         TASK_VIEW_SCRIPT,
         "uai-task-view",
         TASK_HOSTS_VIEW_PATH,
+        ...anchor,
         "/usr/bin/setpriv",
         `--reuid=${user}`,
         `--regid=${user}`,
         "--init-groups",
         "--reset-env",
         "--",
+        ...injector,
         shellCommand.command,
         ...shellCommand.args,
       ],
     };
   }
+  if (anchor.length > 0) {
+    return {
+      command: anchor[0]!,
+      args: [...anchor.slice(1), ...injector, shellCommand.command, ...shellCommand.args],
+    };
+  }
   return shellCommand;
 }
 
+/**
+ * ADR-154 §6: what an anchored launch starts from, instead of this runner's
+ * own environment (its host credential, its AWS keys): neither the engine
+ * supervisor nor the engine it starts inherits anything of the runner's.
+ * The drop resets it again for the task user; the launch's own line and
+ * login shell give the engine the rest.
+ */
+const ANCHORED_LAUNCH_ENV: NodeJS.ProcessEnv = Object.freeze({ PATH: BASELINE_PATH });
+
 class SelfTaskEnvironmentHandle implements TaskEnvironmentHandle {
   readonly descriptor: TaskEnvironmentDescriptor;
   readonly durableIdentity: string;
+  /** ADR-154 §6: a request's environment rides a local shell line, so a
+   *  leased launch's engine credentials travel in its admission. */
+  readonly credentialDelivery = "admission";
   readonly #value: SelfTaskEnvironmentLocatorValue;
   readonly #spawn: typeof nodeSpawn;
   readonly #privileged: () => boolean;
   readonly #etcEnvironment: () => Readonly<Record<string, string>>;
+  readonly #anchorWithoutIsolation: boolean;
 
   constructor(
     locator: TaskEnvironmentLocator,
@@ -245,6 +269,7 @@ class SelfTaskEnvironmentHandle implements TaskEnvironmentHandle {
     this.#privileged =
       deps.privileged ?? (() => typeof process.getuid === "function" && process.getuid() === 0);
     this.#etcEnvironment = deps.etcEnvironment ?? readEtcEnvironment;
+    this.#anchorWithoutIsolation = deps.anchorWithoutIsolationForTests === true;
     this.durableIdentity = `self:${this.#value.taskId}`;
     this.descriptor = {
       taskId: this.#value.taskId,
@@ -254,17 +279,13 @@ class SelfTaskEnvironmentHandle implements TaskEnvironmentHandle {
     };
   }
 
-  async readWorkspaceFile(path: string): Promise<Uint8Array | null> {
+  async readWorkspaceFile(path: string, options?: TaskEnvironmentReadOptions): Promise<Uint8Array | null> {
     assertWorkspaceScopedPath(this.descriptor, path);
-    try {
-      return new Uint8Array(await readFile(path));
-    } catch (error) {
-      if ((error as NodeJS.ErrnoException).code === "ENOENT") return null;
-      throw error;
-    }
+    options?.admit?.();
+    return readBoundedFile(this.descriptor.workspacePath, workspacePathParts(this.descriptor, path), options);
   }
 
-  async writeWorkspaceFile(path: string, bytes: Uint8Array): Promise<void> {
+  async writeWorkspaceFile(path: string, bytes: Uint8Array, options?: TaskEnvironmentCallOptions): Promise<void> {
     assertWorkspaceScopedPath(this.descriptor, path);
     // Through the task user, so the file is owned like everything else the
     // agents touch (a root-owned file inside the workspace is a trap).
@@ -274,6 +295,7 @@ class SelfTaskEnvironmentHandle implements TaskEnvironmentHandle {
       stdin: bytes,
       timeoutMs: 120_000,
       maxOutputBytes: 1024 * 1024,
+      ...(options?.admit ? { admit: options.admit } : {}),
     });
     if (result.exitCode !== 0) {
       throw new Error(
@@ -282,15 +304,41 @@ class SelfTaskEnvironmentHandle implements TaskEnvironmentHandle {
     }
   }
 
+  /** ADR-154 §6: anchored requests start under the engine supervisor, only
+   * where it runs as root and the engine as the task user: otherwise the
+   * supervisor, and what a launch carries, would be the task user's own. */
+  get anchors(): boolean {
+    return this.#privileged() || this.#anchorWithoutIsolation;
+  }
+
+  /** The command for `request`, and the environment it starts with: an
+   *  anchored one starts from the explicit baseline, never this runner's,
+   *  and only where the supervisor is isolated from the task user. */
+  #command(
+    request: Parameters<typeof selfCommand>[0],
+    mode: "interactive" | "detached",
+  ): { command: string; args: string[]; env?: NodeJS.ProcessEnv } {
+    if (request.anchor && !this.anchors) {
+      throw new Error("an anchored launch needs the drop to the task user, as root");
+    }
+    const { command, args } = selfCommand(request, mode, this.#privileged());
+    return request.anchor ? { command, args, env: ANCHORED_LAUNCH_ENV } : { command, args };
+  }
+
   /** The request with the machine-wide environment beneath its own: what an
-   * ssh session on a machine task gets from pam_env, applied here by hand. */
+   * ssh session on a machine task gets from pam_env, applied here by hand,
+   * never an engine's credential (ADR-154 §6), and for an anchored launch,
+   * whose secrets come from its admission, no secret of the machine's at
+   * all: its environment rides the local command line. */
   #withMachineEnv<
     T extends {
       env?: Readonly<Record<string, string>>;
       projectEnvProfile: "maintenance" | "task";
+      anchor?: unknown;
     },
   >(request: T): T {
-    const base = this.#etcEnvironment();
+    const etc = this.#etcEnvironment();
+    const base = request.anchor ? withoutLaunchSecrets(etc) : withoutEngineCredentials(etc);
     const withMachineEnv =
       Object.keys(base).length === 0
         ? request
@@ -306,16 +354,17 @@ class SelfTaskEnvironmentHandle implements TaskEnvironmentHandle {
     assertTaskEnvironmentExecRequest(request);
     refusePrivilegedExec(request);
     const scoped = this.#withMachineEnv(request);
-    const { command, args } = selfCommand(scoped, "interactive", this.#privileged());
+    const { command, args, env } = this.#command(scoped, "interactive");
     request.admit?.();
-    return capturedCliExec(this.#spawn, command, args, scoped);
+    return capturedCliExec(this.#spawn, command, args, scoped, env);
   }
 
   async spawn(request: TaskEnvironmentSpawnRequest): Promise<TaskEnvironmentProcess> {
     assertTaskEnvironmentProcessRequest(request);
     const scoped = this.#withMachineEnv(request);
-    const { command, args } = selfCommand(scoped, "interactive", this.#privileged());
-    return streamingCliExec(this.#spawn, command, args, scoped);
+    const { command, args, env } = this.#command(scoped, "interactive");
+    request.admit?.();
+    return streamingCliExec(this.#spawn, command, args, scoped, env);
   }
 
   async spawnSession(request: TaskEnvironmentSessionRequest): Promise<TaskEnvironmentProcess> {
@@ -324,8 +373,9 @@ class SelfTaskEnvironmentHandle implements TaskEnvironmentHandle {
       ...request,
       cwd: request.cwd ?? this.#value.workspacePath,
     });
-    const { command, args } = selfCommand(session, "interactive", this.#privileged());
-    return streamingCliExec(this.#spawn, command, args, session);
+    const { command, args, env } = this.#command(session, "interactive");
+    request.admit?.();
+    return streamingCliExec(this.#spawn, command, args, session, env);
   }
 
   async launchDetachedSession(
@@ -336,11 +386,18 @@ class SelfTaskEnvironmentHandle implements TaskEnvironmentHandle {
       ...request,
       cwd: request.cwd ?? this.#value.workspacePath,
     });
-    const { command, args } = selfCommand(session, "detached", this.#privileged());
-    return capturedCliExec(this.#spawn, command, args, {
-      ...session,
-      timeoutMs: session.launchTimeoutMs,
-    });
+    const { command, args, env } = this.#command(session, "detached");
+    request.admit?.();
+    return capturedCliExec(
+      this.#spawn,
+      command,
+      args,
+      {
+        ...session,
+        timeoutMs: session.launchTimeoutMs,
+      },
+      env,
+    );
   }
 
   async copy(request: TaskEnvironmentCopyRequest): Promise<void> {
@@ -374,6 +431,7 @@ class SelfTaskEnvironmentHandle implements TaskEnvironmentHandle {
       projectEnvProfile: "maintenance",
       timeoutMs: 5 * 60_000,
       maxOutputBytes: 64 * 1024,
+      ...(request.admit ? { admit: request.admit } : {}),
     });
     if (result.exitCode !== 0) {
       throw new Error(