@runuai/host 0.9.150 → 0.9.152

package/scripts/agent/task-up.sh

@@ -181,17 +181,33 @@ reject_workspace_runtime_shadow() {
 # post-materialization recheck below keeps refusing — by then the root must
 # be empty by construction, so an entry there is a bug, not a user file.
 quarantine_workspace_runtime_shadow() {
-  local path="$task_workspace/.tool-versions" aside_dir aside
+  local path="$task_workspace/.tool-versions" aside_dir aside attempt note
   if [ -L "$path" ] || [ -e "$path" ]; then
     aside_dir="$task_workspace/.uai/refused"
     reject_unsafe_host_directory "$task_workspace/.uai" "the task control directory"
     reject_unsafe_host_directory "$aside_dir" "the refused-files directory"
     mkdir -p "$aside_dir"
+    # Never onto an entry the task left there: mv moves into a directory, or
+    # one a link leads to, outside the workspace (#cb3j0z). The task's
+    # container is gone, so nothing races these checks.
     aside="$aside_dir/tool-versions.$(date +%s)"
+    attempt=0
+    while [ -L "$aside" ] || [ -e "$aside" ]; do
+      attempt=$((attempt + 1))
+      aside="$aside_dir/tool-versions.$(date +%s).$attempt"
+    done
     if ! mv -f "$path" "$aside" 2>/dev/null || [ -L "$path" ] || [ -e "$path" ]; then
       reject_workspace_runtime_shadow
     fi
-    cat > "$aside_dir/README.txt" <<'NOTE'
+    # Nor written through a link or special file in the note's place: that
+    # is removed first (rm never follows a link), and the note is written
+    # only to nothing or a regular file.
+    note="$aside_dir/README.txt"
+    if [ -L "$note" ] || { [ -e "$note" ] && [ ! -f "$note" ]; }; then
+      rm -f "$note" 2>/dev/null || true
+    fi
+    if [ ! -L "$note" ] && { [ ! -e "$note" ] || [ -f "$note" ]; }; then
+      cat > "$note" <<'NOTE'
 Uai moved a /workspace/.tool-versions aside before starting this task.
 
 A .tool-versions at the workspace root is outside the runtime proof and would
@@ -200,6 +216,7 @@ to start a container while one exists. The file is kept here, untouched, under
 its original content. Pin runtimes in a project's own .tool-versions instead
 (/workspace/<project>/.tool-versions), which the materializer proves.
 NOTE
+    fi
     log "moved a workspace-root .tool-versions aside to ${aside#"$task_workspace"/} (it would override the runtimes proved for this task; pin per project instead)"
   fi
 }
@@ -640,6 +657,25 @@ task_uai_dir_physical="$task_dir_physical/.uai"
 # 3. Bare mirrors + worktrees, one per selected project.
 # -----------------------------------------------------------------------------
 
+# ADR-154 §12: a task on cloud credentials tells the runner where it is
+# with an event file in this private directory (event-clone-done, then
+# event-runtime-ready), and finds the runner's answer to runtime-ready there
+# too. Never on stderr, which a subprocess shares; the path is unset here so
+# no process task-up starts inherits it; nothing blocks.
+uai_handshake_dir="${UAI_TASK_HANDSHAKE_DIR:-}"
+unset UAI_TASK_HANDSHAKE_DIR
+# A task on cloud credentials: every host Git operation runs with nothing of
+# the runner's own (no home, so no .netrc, ~/.gitconfig or ~/.ssh/config),
+# by exactly the route its lease names, and never falls back to another.
+uai_leased_git=0
+if [ -n "$uai_handshake_dir" ]; then
+  uai_leased_git=1
+fi
+# ADR-154 §6: no default slot. A task on cloud credentials gets none of the
+# runner owner's own engine sign-ins: not their tokens in its env (the
+# runner strips them from ours), not their config directories in its home.
+uai_on_cloud_credentials=$uai_leased_git
+
 # Prepare the optional SSH identity. Connected users fetch over HTTPS with
 # their per-host GitHub credential; SSH is used for Git transport only when the
 # task owner has not connected GitHub. `IdentitiesOnly=yes` +
@@ -650,30 +686,59 @@ task_uai_dir_physical="$task_dir_physical/.uai"
 # $UAI_TASK_IDENTITY_DIR by the orchestrator) so clone + push run as them. A
 # task must never borrow the operator's shared identity: that would authorize
 # one user as a different principal.
+#
+# ADR-154 §12: a task on cloud credentials gets no key file. The runner
+# holds the owner's key in its own memory behind a private agent socket for
+# exactly as long as this clone ($UAI_TASK_SSH_AUTH_SOCK, with the public
+# key naming the identity); ssh asks that agent and nothing else.
 if [ -n "${UAI_TASK_IDENTITY_DIR:-}" ] && [ -f "${UAI_TASK_IDENTITY_DIR}/id_ed25519" ]; then
   uai_identity_key="$UAI_TASK_IDENTITY_DIR/id_ed25519"
   log "git over SSH using the task creator's per-user key"
 else
   uai_identity_key=""
 fi
+uai_task_ssh_auth_sock="${UAI_TASK_SSH_AUTH_SOCK:-}"
+uai_task_ssh_public_key="${UAI_TASK_SSH_PUBLIC_KEY:-}"
+unset UAI_TASK_SSH_AUTH_SOCK UAI_TASK_SSH_PUBLIC_KEY
 uai_has_ssh_identity=0
+uai_leased_ssh=0
+uai_known_hosts="$UAI_DATA_DIR/identity/known_hosts"
 if [ -n "$uai_identity_key" ] && [ -f "$uai_identity_key" ]; then
   uai_has_ssh_identity=1
-  uai_known_hosts="$UAI_DATA_DIR/identity/known_hosts"
   GIT_SSH_COMMAND="ssh -i $uai_identity_key -o IdentitiesOnly=yes -o IdentityAgent=none -o BatchMode=yes -o StrictHostKeyChecking=accept-new"
   [ -f "$uai_known_hosts" ] && GIT_SSH_COMMAND="$GIT_SSH_COMMAND -o UserKnownHostsFile=$uai_known_hosts"
   export GIT_SSH_COMMAND
   log "git over SSH using $uai_identity_key (1Password agent bypassed)"
+elif [ -n "$uai_task_ssh_auth_sock" ] && [ -S "$uai_task_ssh_auth_sock" ] && [ -f "$uai_task_ssh_public_key" ]; then
+  uai_has_ssh_identity=1
+  uai_leased_ssh=1
+  GIT_SSH_COMMAND="ssh -F /dev/null -i $uai_task_ssh_public_key -o IdentitiesOnly=yes -o IdentityAgent=$uai_task_ssh_auth_sock -o BatchMode=yes -o StrictHostKeyChecking=accept-new"
+  [ -f "$uai_known_hosts" ] && GIT_SSH_COMMAND="$GIT_SSH_COMMAND -o UserKnownHostsFile=$uai_known_hosts"
+  export GIT_SSH_COMMAND
+  log "git over SSH using the task owner's key, held in the runner's memory"
 else
   log "no SSH identity for the task owner — SSH transport fallback unavailable"
 fi
 
-# Only the non-secret path reaches this script. The task owner's token lives in
-# a private per-task `git credential-cache` daemon and is never placed in the
-# environment, argv, remote URL, mirror config, Compose, or logs.
+# Only a non-secret path reaches this script. The task owner's token lives in
+# a private per-task `git credential-cache` daemon, or, for a task on cloud
+# credentials (ADR-154 §12), in the runner's own memory behind the helper
+# $UAI_GITHUB_CREDENTIAL_HELPER asks for exactly as long as this clone. It is
+# never placed in the environment, argv, remote URL, mirror config, Compose,
+# or logs. Only the daemon's token is installed in the container below; a
+# task on cloud credentials has its GitHub configuration written by the
+# runner, which records it for cleanup.
 github_credential_socket="${UAI_GITHUB_CREDENTIAL_SOCKET:-}"
-unset UAI_GITHUB_CREDENTIAL_SOCKET
-if [ -n "$github_credential_socket" ]; then
+github_credential_helper="${UAI_GITHUB_CREDENTIAL_HELPER:-}"
+unset UAI_GITHUB_CREDENTIAL_SOCKET UAI_GITHUB_CREDENTIAL_HELPER
+if [ -n "$github_credential_helper" ]; then
+  github_git_helper="$github_credential_helper"
+elif [ -n "$github_credential_socket" ]; then
+  github_git_helper="cache --socket=$github_credential_socket"
+else
+  github_git_helper=""
+fi
+if [ -n "$github_git_helper" ]; then
   uai_git_transport="https"
 else
   # Refined after each GitHub fetch below: select SSH only when it was the
@@ -683,6 +748,67 @@ else
 fi
 uai_used_ssh_transport=0
 
+# ADR-154 §12: a task on cloud credentials runs every host Git operation in an
+# environment rebuilt from an allowlist (env -i), never the runner process's
+# own: an ambient GIT_CONFIG_COUNT and its numbered pairs, GIT_EXEC_PATH, an
+# askpass or an agent socket could otherwise redirect or answer its route.
+# What passes is what finds git and ssh and reaches the network (the PATH, the
+# temporary directory, proxies, the CA bundle), never a credential, a
+# configuration or a route.
+uai_git_passthrough=()
+if [ "$uai_leased_git" = "1" ]; then
+  for uai_git_name in PATH TMPDIR http_proxy https_proxy all_proxy no_proxy \
+    HTTP_PROXY HTTPS_PROXY ALL_PROXY NO_PROXY SSL_CERT_FILE SSL_CERT_DIR; do
+    if [ -n "${!uai_git_name:-}" ]; then
+      uai_git_passthrough+=("$uai_git_name=${!uai_git_name}")
+    fi
+  done
+fi
+
+# Runs git with the NAME=VALUE assignments before `--`, then `git "$@"`: for a
+# task on cloud credentials in those, the allowlist and no home alone;
+# otherwise on top of this process's environment, which the wrappers below
+# narrow themselves.
+uai_git() {
+  local uai_assign=()
+  while [ "$#" -gt 0 ] && [ "$1" != "--" ]; do
+    uai_assign+=("$1")
+    shift
+  done
+  shift
+  if [ "$uai_leased_git" = "1" ]; then
+    env -i ${uai_git_passthrough[@]+"${uai_git_passthrough[@]}"} \
+      HOME=/nonexistent XDG_CONFIG_HOME=/nonexistent LC_ALL=C \
+      GIT_CONFIG_GLOBAL=/dev/null GIT_CONFIG_NOSYSTEM=1 \
+      ${uai_assign[@]+"${uai_assign[@]}"} git "$@"
+  else
+    env ${uai_assign[@]+"${uai_assign[@]}"} git "$@"
+  fi
+}
+
+# ADR-154 §12: a task on cloud credentials that GitHub refused says which of
+# its owner's credentials was refused (the lease's GitHub sign-in or SSH key)
+# and where to fix that: Uai's Settings, never this host.
+emit_leased_github_denial() {
+  case "$1" in
+    token)
+      emit_err "GITHUB_TOKEN_ACCESS_DENIED" \
+        "GitHub denied the task owner's GitHub sign-in access to $2. Confirm that the Uai GitHub App is installed on the owning account or organization, this repository is included in its grant, and the owner can read it. Then start the task again." \
+        "$3"
+      ;;
+    ssh)
+      emit_err "GITHUB_SSH_ACCESS_DENIED" \
+        "GitHub denied the task owner's SSH key access to $2. Register that key with an account that can read the repository (and authorize it for SAML SSO when required), or connect GitHub in Settings. Then start the task again." \
+        "$3"
+      ;;
+    *)
+      emit_err "GITHUB_CONNECTION_REQUIRED" \
+        "The task owner has neither a GitHub sign-in nor an SSH key in Uai that can read $2. Connect GitHub in Settings, then start the task again." \
+        "$3"
+      ;;
+  esac
+}
+
 git_with_github_credential() (
   unset GIT_ASKPASS SSH_ASKPASS SSH_AUTH_SOCK GIT_CONFIG \
     GIT_CONFIG_PARAMETERS GIT_TRACE GIT_TRACE2 GIT_TRACE_CURL \
@@ -690,13 +816,13 @@ git_with_github_credential() (
   export LC_ALL=C GIT_CONFIG_GLOBAL=/dev/null GIT_CONFIG_NOSYSTEM=1
   # If a container ever poisoned a shared mirror's URL config, fail closed
   # instead of silently switching this operation to an SSH principal.
-  GIT_SSH_COMMAND=/bin/false GIT_TERMINAL_PROMPT=0 git \
+  uai_git GIT_SSH_COMMAND=/bin/false GIT_TERMINAL_PROMPT=0 -- \
     -c core.hooksPath=/dev/null \
     -c core.fsmonitor=false \
     -c http.extraHeader= \
     -c http.sslVerify=true \
     -c credential.helper= \
-    -c "credential.helper=cache --socket=$github_credential_socket" \
+    -c "credential.helper=$github_git_helper" \
     "$@"
 )
 
@@ -707,7 +833,8 @@ git_with_github_ssh() (
     GIT_CONFIG_PARAMETERS GIT_TRACE GIT_TRACE2 GIT_TRACE_CURL \
     GIT_TRACE_PACKET GIT_TRACE_REDACT
   export LC_ALL=C GIT_CONFIG_GLOBAL=/dev/null GIT_CONFIG_NOSYSTEM=1
-  GIT_TERMINAL_PROMPT=0 git \
+  # The SSH command chosen above: the task owner's identity, nothing else.
+  uai_git "GIT_SSH_COMMAND=${GIT_SSH_COMMAND:-/bin/false}" GIT_TERMINAL_PROMPT=0 -- \
     -c core.hooksPath=/dev/null \
     -c core.fsmonitor=false \
     -c 'url.git@github.com:.insteadOf=https://github.com/' \
@@ -721,7 +848,7 @@ git_anonymous_https() (
     GIT_CONFIG_PARAMETERS GIT_TRACE GIT_TRACE2 GIT_TRACE_CURL \
     GIT_TRACE_PACKET GIT_TRACE_REDACT
   export LC_ALL=C GIT_CONFIG_GLOBAL=/dev/null GIT_CONFIG_NOSYSTEM=1
-  GIT_SSH_COMMAND=/bin/false GIT_TERMINAL_PROMPT=0 git \
+  uai_git GIT_SSH_COMMAND=/bin/false GIT_TERMINAL_PROMPT=0 -- \
     -c core.hooksPath=/dev/null \
     -c core.fsmonitor=false \
     -c http.extraHeader= \
@@ -744,11 +871,11 @@ git_host_control() (
   # This helper is for local repository bookkeeping and public/local remotes.
   # It must never inherit the operator's SSH agent or credential helper. Every
   # authenticated GitHub fetch goes through one of the explicit helpers above.
-  GIT_CONFIG_COUNT=3 \
-  GIT_CONFIG_KEY_0=core.hooksPath GIT_CONFIG_VALUE_0=/dev/null \
-  GIT_CONFIG_KEY_1=core.fsmonitor GIT_CONFIG_VALUE_1=false \
-  GIT_CONFIG_KEY_2=advice.defaultBranchName GIT_CONFIG_VALUE_2=false \
-  GIT_SSH_COMMAND=/bin/false GIT_TERMINAL_PROMPT=0 git \
+  uai_git GIT_CONFIG_COUNT=3 \
+    GIT_CONFIG_KEY_0=core.hooksPath GIT_CONFIG_VALUE_0=/dev/null \
+    GIT_CONFIG_KEY_1=core.fsmonitor GIT_CONFIG_VALUE_1=false \
+    GIT_CONFIG_KEY_2=advice.defaultBranchName GIT_CONFIG_VALUE_2=false \
+    GIT_SSH_COMMAND=/bin/false GIT_TERMINAL_PROMPT=0 -- \
     -c credential.helper= \
     "$@"
 )
@@ -937,7 +1064,15 @@ if [ "$shared_files_mode" != "off" ]; then
   [ -n "$shared_owner_user" ] && mkdir -p "$shared_root/users/$shared_owner_user"
   # Marker for the preamble: only containers that actually carry the mounts
   # get the "## Shared files" briefing (pre-feature containers don't).
-  : > "$task_workspace/.uai/files-mounted"
+  # Never written through a link or special file the task left in its place
+  # (#cb3j0z): that is removed first (rm never follows a link), and nothing
+  # is written where anything remains. The task's container is gone, so
+  # nothing races this.
+  files_mounted="$task_workspace/.uai/files-mounted"
+  if [ -L "$files_mounted" ] || { [ -e "$files_mounted" ] && [ ! -f "$files_mounted" ]; }; then
+    rm -f "$files_mounted" 2>/dev/null || true
+  fi
+  [ -L "$files_mounted" ] || [ -e "$files_mounted" ] || : > "$files_mounted"
 fi
 
 # Iterate using jq -c so each project is a single JSON object per line.
@@ -1062,7 +1197,7 @@ while IFS= read -r project_obj; do
     # the next attempt starts fresh rather than re-using a half-init.
     fetch_err=""
     fetch_failed=0
-    if [ -n "$github_https_url" ] && [ -n "$github_credential_socket" ]; then
+    if [ -n "$github_https_url" ] && [ -n "$github_git_helper" ]; then
       github_fetch_mode="token"
       if ! fetch_err=$(git_with_github_credential \
         -C "$mirror_dir" fetch origin 2>&1); then
@@ -1075,8 +1210,9 @@ while IFS= read -r project_obj; do
           -C "$mirror_dir" fetch origin 2>&1); then
           fetch_failed=1
           # github.com requires an authenticated SSH handshake even for public
-          # repositories. Preserve the no-credential public-repo path.
-          if git_anonymous_https -C "$mirror_dir" fetch origin \
+          # repositories. Preserve the no-credential public-repo path, except
+          # for a key a task's lease names: its route fails closed.
+          if [ "$uai_leased_ssh" != "1" ] && git_anonymous_https -C "$mirror_dir" fetch origin \
             >/dev/null 2>&1; then
             github_fetch_mode="anonymous"
             fetch_failed=0
@@ -1108,6 +1244,9 @@ while IFS= read -r project_obj; do
 *"Authentication failed"*|*"Invalid username or password"*|*"HTTP 401"*|\
 *"HTTP 403"*|*"HTTP 404"*|*"requested URL returned error: 401"*|\
 *"requested URL returned error: 403"*|*"requested URL returned error: 404"*)
+          if [ "$uai_leased_git" = "1" ]; then
+            emit_leased_github_denial "$github_fetch_mode" "$repo_url" "bare-clone ($project_id)"
+          fi
           if [ "$github_fetch_mode" = "token" ]; then
             emit_err "GITHUB_TOKEN_ACCESS_DENIED" \
               "GitHub denied the connected user's access to $repo_url. Confirm that the Uai GitHub App is installed on the owning account or organization, this repository is included in its grant, and the connected user can write to it. Then retry the task." \
@@ -1148,7 +1287,7 @@ while IFS= read -r project_obj; do
     step "FETCH_FAILED" "git fetch origin ($project_id)"
     fetch_ok=0
     fetch_err=""
-    if [ -n "$github_https_url" ] && [ -n "$github_credential_socket" ]; then
+    if [ -n "$github_https_url" ] && [ -n "$github_git_helper" ]; then
       github_fetch_mode="token"
       if fetch_err=$(git_with_github_credential \
         -C "$mirror_dir" fetch origin 2>&1); then
@@ -1164,7 +1303,8 @@ while IFS= read -r project_obj; do
       else
         github_fetch_mode="none"
       fi
-      if [ "$fetch_ok" != "1" ]; then
+      # A key a task's lease names never falls back to another principal.
+      if [ "$fetch_ok" != "1" ] && [ "$uai_leased_ssh" != "1" ]; then
         anonymous_err=""
         if anonymous_err=$(git_anonymous_https \
           -C "$mirror_dir" fetch origin 2>&1); then
@@ -1185,6 +1325,9 @@ while IFS= read -r project_obj; do
 *"Authentication failed"*|*"Invalid username or password"*|*"HTTP 401"*|\
 *"HTTP 403"*|*"HTTP 404"*|*"requested URL returned error: 401"*|\
 *"requested URL returned error: 403"*|*"requested URL returned error: 404"*)
+          if [ "$uai_leased_git" = "1" ]; then
+            emit_leased_github_denial "$github_fetch_mode" "$repo_url" "git fetch origin ($project_id)"
+          fi
           case "$github_fetch_mode" in
             token)
               emit_err "GITHUB_TOKEN_ACCESS_DENIED" \
@@ -1385,6 +1528,12 @@ while IFS= read -r project_obj; do
   release_project_lock
 done < <(jq -c '.[]' <<<"$projects_json")
 
+# Every host Git operation is over: a task on cloud credentials stops being
+# served its owner's GitHub token and SSH key now.
+if [ -n "$uai_handshake_dir" ]; then
+  : > "$uai_handshake_dir/event-clone-done"
+fi
+
 # Git and the checked-out files were created by the host. Reconcile their
 # group/modes only after every host Git operation and before Compose exposes
 # them to uid 1000. The host-only marker avoids recursively walking a large
@@ -1430,7 +1579,7 @@ fi
 share_task_tree_with_container "$task_uai_dir/repos" \
   "task-private Git repositories"
 
-if [ -z "$github_credential_socket" ] && [ "$uai_used_ssh_transport" = "1" ]; then
+if [ -z "$github_git_helper" ] && [ "$uai_used_ssh_transport" = "1" ]; then
   uai_git_transport="ssh"
 fi
 
@@ -1627,13 +1776,13 @@ is_reserved_task_env_name() {
     NODE_PATH | SHELLOPTS | BASHOPTS | PS4 | BASH_ENV | ENV | \
     __UAI_ENV_* | __CURSOR_SANDBOX_ENV_RESTORE | GROK_LOGIN_ENV | \
     NODE_EXTRA_CA_CERTS | SSL_CERT_FILE | REQUESTS_CA_BUNDLE | \
-    ASDF_* | COREPACK_* | \
+    [Aa][Ss][Dd][Ff]_* | [Cc][Oo][Rr][Ee][Pp][Aa][Cc][Kk]_* | \
     [Nn][Pp][Mm]_[Cc][Oo][Nn][Ff][Ii][Gg]_[Pp][Rr][Ee][Ff][Ii][Xx] | \
     [Nn][Pp][Mm]_[Cc][Oo][Nn][Ff][Ii][Gg]_[Cc][Aa][Cc][Hh][Ee] | \
     [Nn][Pp][Mm]_[Cc][Oo][Nn][Ff][Ii][Gg]_[Ll][Oo][Gg][Ss][_-][Dd][Ii][Rr] | \
     [Nn][Pp][Mm]_[Cc][Oo][Nn][Ff][Ii][Gg]_[Uu][Mm][Aa][Ss][Kk] | UAI_* | \
     CLAUDE_CODE_OAUTH_TOKEN | \
-    ANTHROPIC_API_KEY | ANTHROPIC_AUTH_TOKEN | XAI_API_KEY | \
+    ANTHROPIC_API_KEY | ANTHROPIC_AUTH_TOKEN | XAI_API_KEY | CURSOR_API_KEY | \
     PLAYWRIGHT_BROWSERS_PATH)
       return 0
       ;;
@@ -1641,6 +1790,30 @@ is_reserved_task_env_name() {
   return 1
 }
 
+# A baked task's project env, as both runtimes receive it (Docker's Compose
+# override, Apple's env file): values JSON on stdin; $1 the declared keys
+# (JSON array), $2 the preview URL env (JSON object). Declared env names
+# only, minus every name is_reserved_task_env_name reserves (the one
+# authority, never a second list) and the preview URL names.
+filter_baked_project_env() {
+  local declared="$1" preview="$2" values reserved='[]' key
+  values=$(cat)
+  while IFS= read -r key; do
+    if is_reserved_task_env_name "$key"; then
+      reserved=$(jq -c --arg key "$key" '. + [$key]' <<<"$reserved")
+    fi
+  done < <(printf '%s' "$values" | jq -r 'keys[] | select(test("^[A-Za-z_][A-Za-z0-9_]*$"))')
+  printf '%s' "$values" | jq -c \
+    --argjson declared "$declared" \
+    --argjson preview "$preview" \
+    --argjson reserved "$reserved" '
+    with_entries(.key as $key | select($declared | index($key)))
+    | with_entries(select(.key | test("^[A-Za-z_][A-Za-z0-9_]*$")))
+    | delpaths($reserved | map([.]))
+    | delpaths($preview | keys | map([.]))
+    '
+}
+
 # Names that the loader owns are non-secret metadata. Mount the exact launch
 # set read-only so uai-init can remove even the empty clears inherited from a
 # derived image before it starts code-server. The editor daemon itself never
@@ -1844,13 +2017,15 @@ mv -f "$managed_env_keys_tmp" "$managed_env_keys_file"
   # in the container env (rather than the host's ~/.claude mount, which broke
   # with EROFS on session-env writes) means both the orchestrator's headless
   # claude and the code-server terminal's interactive claude authenticate.
-  printf '      %s: "${%s:-}"\n' \
-    "CLAUDE_CODE_OAUTH_TOKEN" "CLAUDE_CODE_OAUTH_TOKEN"
-  # Pasted engine API keys (ADR-070) ride the same at-up interpolation, so the
-  # terminal CLIs authenticate like the adapters' exec-time env forwarding.
-  printf '      %s: "${%s:-}"\n' "ANTHROPIC_API_KEY" "ANTHROPIC_API_KEY"
-  printf '      %s: "${%s:-}"\n' "ANTHROPIC_AUTH_TOKEN" "ANTHROPIC_AUTH_TOKEN"
-  printf '      %s: "${%s:-}"\n' "XAI_API_KEY" "XAI_API_KEY"
+  if [ "$uai_on_cloud_credentials" != "1" ]; then
+    printf '      %s: "${%s:-}"\n' \
+      "CLAUDE_CODE_OAUTH_TOKEN" "CLAUDE_CODE_OAUTH_TOKEN"
+    # Pasted engine API keys (ADR-070) ride the same at-up interpolation, so the
+    # terminal CLIs authenticate like the adapters' exec-time env forwarding.
+    printf '      %s: "${%s:-}"\n' "ANTHROPIC_API_KEY" "ANTHROPIC_API_KEY"
+    printf '      %s: "${%s:-}"\n' "ANTHROPIC_AUTH_TOKEN" "ANTHROPIC_AUTH_TOKEN"
+    printf '      %s: "${%s:-}"\n' "XAI_API_KEY" "XAI_API_KEY"
+  fi
   # ADR-053: point Playwright at the shared browser cache volume.
   printf '      PLAYWRIGHT_BROWSERS_PATH: "/opt/pw-browsers"\n'
   # No GH_TOKEN/GITHUB_TOKEN in the container env (ADR-027). `gh` prefers such
@@ -2184,65 +2359,8 @@ step "COMPOSE_UP_FAILED" "start task container"
 preview_env_raw=$(jq -r '.[0].preview_env // "{}"' <<<"$task_json")
 filtered_project_env='{}'
 if [ "$UAI_PROJECT_ENV_MODE" = "baked" ]; then
-  filtered_project_env=$(printf '%s' "$project_env_json" | jq -c \
-    --argjson declared "$union_env_keys_json" \
-    --argjson preview "$preview_env_raw" '
-    .
-    | with_entries(.key as $key | select($declared | index($key)))
-    | with_entries(select(.key | test("^GIT_CONFIG($|_)") | not))
-    | with_entries(select(.key | test(
-        "^(ASDF_|COREPACK_)|^npm_config_(prefix|cache|logs[_-]dir|umask)$";
-        "i"
-      ) | not))
-    | with_entries(select(.key | test("^UAI_") | not))
-    | with_entries(select(.key | test("^__UAI_ENV_") | not))
-    | del(
-        .GH_TOKEN,
-        .GITHUB_TOKEN,
-        .GH_CONFIG_DIR,
-        .GH_HOST,
-        .GIT_DIR,
-        .GIT_WORK_TREE,
-        .GIT_COMMON_DIR,
-        .GIT_OBJECT_DIRECTORY,
-        .GIT_ALTERNATE_OBJECT_DIRECTORIES,
-        .GIT_INDEX_FILE,
-        .GIT_EXEC_PATH,
-        .GIT_ASKPASS,
-        .SSH_ASKPASS,
-        .GIT_SSH,
-        .GIT_SSH_COMMAND,
-        .HOME,
-        .XDG_CONFIG_HOME,
-        .XDG_DATA_HOME,
-        .XDG_CACHE_HOME,
-        .PATH,
-        .SHELL,
-        .LD_PRELOAD,
-        .LD_AUDIT,
-        .LD_LIBRARY_PATH,
-        .NODE_OPTIONS,
-        .NODE_PATH,
-        .SHELLOPTS,
-        .BASHOPTS,
-        .PS4,
-        .BASH_ENV,
-        .ENV,
-        .NODE_EXTRA_CA_CERTS,
-        .SSL_CERT_FILE,
-        .REQUESTS_CA_BUNDLE,
-        .__CURSOR_SANDBOX_ENV_RESTORE,
-        .GROK_LOGIN_ENV,
-        .UAI_GIT_TRANSPORT,
-        .CLAUDE_CODE_OAUTH_TOKEN,
-        .ANTHROPIC_API_KEY,
-        .ANTHROPIC_AUTH_TOKEN,
-        .XAI_API_KEY,
-        .PLAYWRIGHT_BROWSERS_PATH,
-        .UAI_EDITOR_THEME
-      )
-    | delpaths($preview | keys | map([.]))
-    ')
+  filtered_project_env=$(printf '%s' "$project_env_json" \
+    | filter_baked_project_env "$union_env_keys_json" "$preview_env_raw")
 fi
 compose_env_override=""
 if [ "$TASK_RUNTIME_MODE" = "docker" ]; then
@@ -2352,10 +2470,12 @@ if [ "$TASK_RUNTIME_MODE" = "apple-container" ]; then
     printf 'PS4=\n'
     printf 'BASH_ENV=\n'
     printf 'ENV=\n'
-    printf 'CLAUDE_CODE_OAUTH_TOKEN=%s\n' "${CLAUDE_CODE_OAUTH_TOKEN:-}"
-    printf 'ANTHROPIC_API_KEY=%s\n' "${ANTHROPIC_API_KEY:-}"
-    printf 'ANTHROPIC_AUTH_TOKEN=%s\n' "${ANTHROPIC_AUTH_TOKEN:-}"
-    printf 'XAI_API_KEY=%s\n' "${XAI_API_KEY:-}"
+    if [ "$uai_on_cloud_credentials" != "1" ]; then
+      printf 'CLAUDE_CODE_OAUTH_TOKEN=%s\n' "${CLAUDE_CODE_OAUTH_TOKEN:-}"
+      printf 'ANTHROPIC_API_KEY=%s\n' "${ANTHROPIC_API_KEY:-}"
+      printf 'ANTHROPIC_AUTH_TOKEN=%s\n' "${ANTHROPIC_AUTH_TOKEN:-}"
+      printf 'XAI_API_KEY=%s\n' "${XAI_API_KEY:-}"
+    fi
     printf 'PLAYWRIGHT_BROWSERS_PATH=/opt/pw-browsers\n'
     if [ "$UAI_PROJECT_ENV_MODE" = "loader" ]; then
       while IFS= read -r ekey; do
@@ -3295,7 +3415,7 @@ fi
 # CLI atomically rewrites the file on every start, which can invalidate
 # the bind mount and leave a stale dentry, after which claude refuses to
 # start. docker cp gives the container its own stable copy. Best-effort.
-if [ -f "$UAI_OWNER_HOME/.claude.json" ]; then
+if [ "$uai_on_cloud_credentials" != "1" ] && [ -f "$UAI_OWNER_HOME/.claude.json" ]; then
   crt cp "$UAI_OWNER_HOME/.claude.json" \
     "$app_container":/home/node/.claude.json >/dev/null 2>&1 \
     || log "warning: crt cp of .claude.json failed; claude may need re-login"
@@ -3313,6 +3433,7 @@ fi
 if crt exec -u root "${managed_exec_env[@]}" "$app_container" \
     /usr/bin/mkdir -p /home/node/.codex >/dev/null; then
   for codex_item in auth.json config.toml AGENTS.md version.json installation_id rules; do
+    [ "$uai_on_cloud_credentials" = "1" ] && continue
     if [ -e "$UAI_OWNER_HOME/.codex/$codex_item" ]; then
       # ADR-135: the task's copy must not carry the rotating refresh token —
       # N copies racing to refresh it revoke the whole family. Replace it with
@@ -3348,16 +3469,16 @@ fi
 # session state) so the container's kimi runs on the operator's subscription.
 crt exec -u root "${managed_exec_env[@]}" "$app_container" \
   /usr/bin/mkdir -p /home/node/.kimi-code/credentials >/dev/null 2>&1 || true
-if [ -e "$UAI_OWNER_HOME/.kimi-code/config.toml" ]; then
+if [ "$uai_on_cloud_credentials" != "1" ] && [ -e "$UAI_OWNER_HOME/.kimi-code/config.toml" ]; then
   crt cp "$UAI_OWNER_HOME/.kimi-code/config.toml" \
     "$app_container":/home/node/.kimi-code/config.toml >/dev/null 2>&1 \
     || log "warning: crt cp of .kimi-code/config.toml failed; kimi may need re-login"
 fi
-if [ -e "$UAI_OWNER_HOME/.kimi-code/device_id" ]; then
+if [ "$uai_on_cloud_credentials" != "1" ] && [ -e "$UAI_OWNER_HOME/.kimi-code/device_id" ]; then
   crt cp "$UAI_OWNER_HOME/.kimi-code/device_id" \
     "$app_container":/home/node/.kimi-code/device_id >/dev/null 2>&1 || true
 fi
-if [ -e "$UAI_OWNER_HOME/.kimi-code/credentials/kimi-code.json" ]; then
+if [ "$uai_on_cloud_credentials" != "1" ] && [ -e "$UAI_OWNER_HOME/.kimi-code/credentials/kimi-code.json" ]; then
   crt cp "$UAI_OWNER_HOME/.kimi-code/credentials/kimi-code.json" \
     "$app_container":/home/node/.kimi-code/credentials/kimi-code.json >/dev/null 2>&1 \
     || log "warning: crt cp of .kimi-code credential failed; kimi may need re-login"
@@ -3373,6 +3494,7 @@ crt exec -u root "${managed_exec_env[@]}" "$app_container" \
 crt exec -u root "${managed_exec_env[@]}" "$app_container" \
   /usr/bin/mkdir -p /home/node/.grok >/dev/null 2>&1 || true
 for grok_item in auth.json config.toml models_cache.json agent_id; do
+  [ "$uai_on_cloud_credentials" = "1" ] && continue
   if [ -e "$UAI_OWNER_HOME/.grok/$grok_item" ]; then
     if [ "$grok_item" = auth.json ] && command -v jq >/dev/null 2>&1; then
       brokered_auth="$(mktemp "${TMPDIR:-/tmp}/uai-grok-auth.XXXXXX")"
@@ -3401,6 +3523,7 @@ crt exec -u root "${managed_exec_env[@]}" "$app_container" \
 # (provisionEngineAccounts) since they live in the sealed DB, not on disk here.
 # The shared parent and this leaf were created with node ownership above.
 for oc_item in auth.json config.json; do
+  [ "$uai_on_cloud_credentials" = "1" ] && continue
   if [ -e "$UAI_OWNER_HOME/.local/share/opencode/$oc_item" ]; then
     crt cp "$UAI_OWNER_HOME/.local/share/opencode/$oc_item" \
       "$app_container":/home/node/.local/share/opencode/ >/dev/null 2>&1 \
@@ -3443,6 +3566,25 @@ quarantine_runtime_authority_violation() {
   quarantine_untrusted_app_container
 }
 
+# ADR-154 §12: the runner writes a task on cloud credentials its owner's
+# GitHub configuration and SSH key, recorded for cleanup, now: after the
+# managed-auth scrub, before uai-init installs anything that may need them.
+# task-up waits for its answer, bounded, and stops on anything but continue.
+if [ -n "$uai_handshake_dir" ]; then
+  : > "$uai_handshake_dir/event-runtime-ready"
+  uai_waited=0
+  while [ ! -f "$uai_handshake_dir/runtime-ready" ] && [ "$uai_waited" -lt 3000 ]; do
+    sleep 0.2
+    uai_waited=$((uai_waited + 1))
+  done
+  uai_runtime_ready=$(cat "$uai_handshake_dir/runtime-ready" 2>/dev/null || true)
+  if [ "$uai_runtime_ready" != "continue" ]; then
+    emit_err "CREDENTIALS_UNAVAILABLE" \
+      "Uai could not write the task's GitHub sign-in and SSH key into it. Start the task again." \
+      "write the task's credentials"
+  fi
+fi
+
 init_warning=""
 init_rc=0
 crt exec "${task_runtime_exec_env[@]}" "$app_container" \