@runuai/host 0.9.154 → 0.9.156

package/lib/agent-cli.ts

@@ -210,7 +210,14 @@ export function agentCliEnv(
   return {
     ...runtimeAuthority,
     UAI_TASK_TOKEN: signTaskToken(
-      { taskId, userId: ownerUserId, permissions, agentId: agent.id },
+      {
+        taskId,
+        userId: ownerUserId,
+        permissions,
+        agentId: agent.id,
+        // ADR-157 §3: binds the token to this agent, not merely its handle.
+        ...(agent.tokenGeneration ? { generation: agent.tokenGeneration } : {}),
+      },
       cliSecret,
     ),
     UAI_API_URL: apiUrl,
@@ -312,6 +319,58 @@ async function main() {
     }
     return;
   }
+  if (group === "crew") {
+    // ADR-157: the task's built-in Astronaut (the @astronaut Uai builds, never a
+    // persona) changes its own crew. One agent per call, always with a --why.
+    const handleOf = (v) => (typeof v === "string" && v.startsWith("@") ? v.slice(1) : v);
+    const launch = (a) => a.kind + (a.model ? "/" + a.model : "") + (a.effort ? "/" + a.effort : "");
+    if (action === "list") { out(await api("GET", "/api/agent/crew")); return; }
+    if (action === "add") {
+      const personaId = pos[0];
+      if (!personaId || !flags.why) {
+        console.error('uai: crew add needs a persona id (see crew list) and --why "<reason>"');
+        process.exit(1);
+      }
+      const body = { personaId, why: flags.why };
+      if (flags.as) body.handle = handleOf(flags.as);
+      if (flags.engine) body.kind = flags.engine;
+      if (flags.model) body.model = flags.model;
+      if (flags.effort) body.effort = flags.effort;
+      const r = await api("POST", "/api/agent/crew", body);
+      out("added @" + r.agent.id + " (" + r.agent.label + ") on " + launch(r.agent) + ". It stays idle until you dispatch work to it.");
+      return;
+    }
+    if (action === "model") {
+      const id = handleOf(pos[0] || "");
+      if (!id || !flags.why || !(flags.model || flags.engine || flags.effort)) {
+        console.error('uai: crew model needs @agent, at least one of --engine, --model and --effort, and --why "<reason>"');
+        process.exit(1);
+      }
+      // "default" clears the setting back to the engine's own default (null).
+      const cleared = (v) => (v === "default" ? null : v);
+      const body = { why: flags.why };
+      if (flags.engine) body.kind = flags.engine;
+      if (flags.model) body.model = cleared(flags.model);
+      if (flags.effort) body.effort = cleared(flags.effort);
+      const r = await api("PATCH", "/api/agent/crew/" + encodeURIComponent(id), body);
+      out(r.changed
+        ? "@" + id + " now runs on " + launch(r.agent) + "; its session restarts after its current turn"
+        : "@" + id + " already runs on " + launch(r.agent) + "; nothing changed");
+      return;
+    }
+    if (action === "remove") {
+      const id = handleOf(pos[0] || "");
+      if (!id || !flags.why) {
+        console.error('uai: crew remove needs @agent and --why "<reason>"');
+        process.exit(1);
+      }
+      await api("DELETE", "/api/agent/crew/" + encodeURIComponent(id), { why: flags.why });
+      out("removed @" + id);
+      return;
+    }
+    console.error("uai: crew commands are list, add, model and remove (Astronaut only)");
+    process.exit(1);
+  }
   const key = group + " " + (action || "");
   switch (key) {
     case "projects list": out((await api("GET", "/api/agent/projects")).projects); break;
@@ -497,6 +556,10 @@ async function main() {
         "  uai task history                   (list your past tasks)",
         "  uai task read <taskId>             (full chat of a past task you were on)",
         '  uai dispatch @agent [@agent…] "instruction"   (Secretary only)',
+        "  uai crew list                      (Astronaut only: personas, engines, models, limits, roster)",
+        '  uai crew add <personaId> [--as <handle>] [--engine <kind>] [--model <m>] [--effort <e>] --why "<reason>"',
+        '  uai crew model @agent [--engine <kind>] [--model <m|default>] [--effort <e|default>] --why "<reason>"   (at least one of the three)',
+        '  uai crew remove @agent --why "<reason>"',
         "  uai react <heart|check|x> [--msg #id]   (no --msg = the message you were last handed)",
         "  uai whoami",
       ].join("\\n"));

package/lib/agents/claude.ts

@@ -390,6 +390,17 @@ const CLAUDE_FULL_ACCESS_ARGS = [
   "--strict-mcp-config",
 ];
 
+/**
+ * ADR-157 Astronaut profile: the normal tool set, minus Claude Code's native
+ * subagents. An Astronaut's helpers must be crew agents the task can see and
+ * bill; a built-in Agent/Task subagent would run (and spend) outside the crew.
+ */
+const CLAUDE_ASTRONAUT_ARGS = [
+  ...CLAUDE_FULL_ACCESS_ARGS,
+  "--disallowedTools",
+  "Agent,Task",
+];
+
 /**
  * ADR-083 communicator profile. This is deliberately an engine-level tool
  * boundary, not prompt advice: setting sources, hooks, skills, workflows and
@@ -440,7 +451,7 @@ export class ClaudeSession implements AgentSession {
     agent: RosterAgent;
     environment: TaskEnvironmentAgentSessionSurface;
     systemPreamble: string;
-    executionProfile?: "communicator";
+    executionProfile?: "communicator" | "astronaut";
     attachCompatibilityKey?: string;
     agentEnv?: Record<string, string>;
   }) {
@@ -453,7 +464,9 @@ export class ClaudeSession implements AgentSession {
     const cliArgs = [
       ...(args.executionProfile === "communicator"
         ? CLAUDE_COMMUNICATOR_ARGS
-        : CLAUDE_FULL_ACCESS_ARGS),
+        : args.executionProfile === "astronaut"
+          ? CLAUDE_ASTRONAUT_ARGS
+          : CLAUDE_FULL_ACCESS_ARGS),
     ];
     if (process.env.UAI_CLAUDE_INCLUDE_PARTIAL_MESSAGES === "1") {
       cliArgs.push("--include-partial-messages");
@@ -704,6 +717,10 @@ register({
       defaultModel: CLAUDE_COMMUNICATOR_MODEL,
       defaultEffort: CLAUDE_COMMUNICATOR_EFFORT,
     },
+    {
+      id: "astronaut",
+      mechanism: "claude-disallowed-agent-task-v1",
+    },
   ],
   // Usable only when a Claude credential is in the env (injected into task
   // containers at task-up). Gates advertisement (ADR-044 P2).

package/lib/agents/codex.ts

@@ -391,6 +391,8 @@ export class CodexSession implements AgentSession {
     attachCompatibilityKey?: string;
     /** ADR-128: `-c key=value` overrides a delegating adapter prepends. */
     cliConfigOverrides?: string[];
+    /** ADR-157: the Astronaut runs without Codex's native multi-agent tools. */
+    executionProfile?: "communicator" | "astronaut";
   }) {
     this.agentId = args.agent.id;
     this.systemPreamble = args.systemPreamble;
@@ -425,8 +427,15 @@ export class CodexSession implements AgentSession {
       "shell_snapshot",
       "--disable",
       "shell_snapshot_v2",
-      "app-server",
     );
+    // ADR-157: an Astronaut's helpers must be crew agents the task can see and
+    // bill, so Codex's own subagents (spawn_agent; multi_agent is on by
+    // default in 0.157, multi_agent_v2 off) are disabled for it. Also after
+    // every override, so nothing can turn them back on.
+    if (args.executionProfile === "astronaut") {
+      codexArgs.push("--disable", "multi_agent", "--disable", "multi_agent_v2");
+    }
+    codexArgs.push("app-server");
     // ADR-061: the CLI is owned by an in-container runner (durable across
     // host restarts); legacy pipes behind UAI_DURABLE_SESSIONS=0. Codex
     // re-handshakes per host process (initialize + thread/start live in this
@@ -801,6 +810,9 @@ register({
   defaultModel: CODEX_DEFAULT_MODEL,
   supportedEfforts: () => [...CODEX_EFFORTS],
   defaultEffort: CODEX_DEFAULT_EFFORT,
+  // ADR-157: enforceable by construction (the --disable flags above). The
+  // communicator profile is Claude-only; Codex never declared it.
+  executionProfiles: [{ id: "astronaut", mechanism: "codex-disable-multi-agent-v1" }],
   // Usable only when the owner's ~/.codex login exists — task-up copies it into
   // each container from UAI_OWNER_HOME (default $HOME). Gates advertisement
   // (ADR-044 P2).
@@ -820,6 +832,7 @@ register({
     agentEnv,
     attachCompatibilityKey,
     cliConfigOverrides,
+    executionProfile,
   }) =>
     new CodexSession({
       taskId,
@@ -829,5 +842,6 @@ register({
       agentEnv,
       attachCompatibilityKey,
       cliConfigOverrides,
+      executionProfile,
     }),
 });

package/lib/agents/registry.ts

@@ -88,10 +88,11 @@ export function setAdvertisementFallback(
 }
 
 /**
- * ADR-154: on cloud credentials the runner holds no engine credential of its
- * own, so availability and the fallback above say nothing: the kinds the
- * cloud can lease an account for are advertised, and only those. Null while
- * the runner runs its tasks on its own credentials. Installed by main.ts.
+ * ADR-154 §10: on cloud credentials the runner holds no engine credential of
+ * its own, so availability and the fallback above say nothing: the kinds a
+ * leased task can run are advertised, and only those (`CLOUD_CREDENTIAL_KINDS`:
+ * the leased lanes and the Managed Engine). Null while the runner runs its
+ * tasks on its own credentials. Installed by main.ts.
  */
 let leasedKinds: () => ReadonlySet<string> | null = () => null;
 

package/lib/agents/types.ts

@@ -57,6 +57,9 @@ export const RosterAgent = z.object({
   // ADR-128: which upstream protocol a Uai-engine model speaks — resolved
   // cloud-side from the model catalog; selects the delegated adapter.
   uaiProvider: z.enum(["anthropic", "openai"]).optional(),
+  builtIn: z.literal("astronaut").optional(), // ADR-157: the cloud-built Astronaut only
+  // ADR-157 §3: signed into the agent's task token as `g` (see agentCliEnv).
+  tokenGeneration: z.string().min(1).max(64).optional(),
 });
 export type RosterAgent = z.infer<typeof RosterAgent>;
 
@@ -179,7 +182,7 @@ export interface AgentSessionFactory {
     systemPreamble: string;
     /** Host-derived restricted execution policy (ADR-083). Never supplied by
      *  the browser or stored on the roster entry. */
-    executionProfile?: "communicator";
+    executionProfile?: "communicator" | "astronaut";
     /** Durable runners are keyed by task+agent. Host-owned launch settings
      *  supply a compatibility key so restart recovery replaces, rather than
      *  attaches, a process launched with incompatible model/effort/policy. */

package/lib/agents/uai.ts

@@ -15,7 +15,7 @@
  * the request's `model`, and the gateway maps slug → upstream id.
  */
 
-import { factoryFor, register } from "./registry";
+import { factoryFor, register, supportsExecutionProfile } from "./registry";
 import type { AgentSession, AgentSessionFactory } from "./types";
 
 const DEFAULT_GATEWAY_URL = "https://inference.runuai.com";
@@ -80,6 +80,17 @@ const create: AgentSessionFactory["create"] = async (args): Promise<AgentSession
   if (!delegate) {
     throw new Error(`uai engine: no ${delegateKind} adapter registered to delegate to`);
   }
+  // ADR-157 §7: the runner checked the profile against the `uai` kind, but the
+  // delegate is what enforces it. Refuse rather than run an Astronaut on a
+  // delegate that would ignore the profile.
+  if (
+    args.executionProfile &&
+    !supportsExecutionProfile(delegateKind, args.executionProfile)
+  ) {
+    throw new Error(
+      `uai engine: the ${delegateKind} adapter cannot enforce execution profile "${args.executionProfile}"`,
+    );
+  }
   const taskToken = args.agentEnv?.UAI_TASK_TOKEN;
   if (!taskToken) {
     // agentCliEnv mints no token for a permissionless non-secretary agent;
@@ -110,5 +121,8 @@ register({
   // Always available: the engine needs no host-side credential — auth is
   // the per-agent task token, billing is the org's credits.
   available: () => true,
+  // ADR-157: `create` forwards the profile to the Claude or Codex delegate,
+  // and both enforce it.
+  executionProfiles: [{ id: "astronaut", mechanism: "uai-delegated-astronaut-v1" }],
   create,
 });

package/lib/compose-network-recovery.ts

@@ -0,0 +1,264 @@
+/**
+ * Bounded recovery for Docker's local-network address pool.
+ *
+ * Compose allocates one bridge network per local task. A task that fails after
+ * creating its network can remain resumable in `error`, and Docker retains the
+ * empty network. Enough such networks eventually make every later task fail
+ * with "all predefined address pools have been fully subnetted".
+ *
+ * This sweep is deliberately narrower than `docker network prune`:
+ *
+ * - the exact task/project identity must be present in trusted host state;
+ * - the task must not be starting or running;
+ * - Docker must independently report no attached container; and
+ * - deletion happens inside that task's lifecycle slot, so Resume/Stop cannot
+ *   interleave with the proof.
+ *
+ * Any unreadable or malformed observation means "do nothing", never
+ * permission to delete.
+ */
+
+import type { HostTask } from "../db/schema";
+import { dockerCli, type DockerResult } from "./docker-exec";
+import { getHostTask } from "./runtime-state";
+import { isSafeHostTaskId } from "./task-identity";
+import { isTerminal } from "./task-status";
+import { parseTaskEnvironmentLocator } from "./task-environment/types";
+
+const COMPOSE_PROJECT_LABEL = "com.docker.compose.project";
+const NETWORK_LIST_FORMAT =
+  `{{.ID}}\t{{.Name}}\t{{.Label "${COMPOSE_PROJECT_LABEL}"}}`;
+const MAX_NETWORK_LIST_BYTES = 2 * 1024 * 1024;
+const MAX_NETWORK_INSPECT_BYTES = 1024 * 1024;
+const DOCKER_TIMEOUT_MS = 10_000;
+
+interface ComposeNetworkCandidate {
+  id: string;
+  name: string;
+  composeProject: string;
+  taskId: string;
+}
+
+export interface ComposeNetworkLifecycle {
+  runTaskLifecycle<T>(
+    taskId: string,
+    operation: () => Promise<T>,
+  ): Promise<T>;
+}
+
+export interface ComposeNetworkRecoveryDeps {
+  docker(args: string[], options?: {
+    timeoutMs?: number;
+    maxOutputBytes?: number;
+  }): Promise<DockerResult>;
+  task(taskId: string): HostTask | null;
+}
+
+export interface ComposeNetworkRecoveryResult {
+  inventory: "complete" | "unavailable" | "invalid";
+  candidates: number;
+  removed: number;
+}
+
+const defaultDeps: ComposeNetworkRecoveryDeps = {
+  docker: dockerCli,
+  task: getHostTask,
+};
+
+function parseCandidate(
+  line: string,
+): ComposeNetworkCandidate | "unrelated" | null {
+  const fields = line.split("\t");
+  if (fields.length !== 3) return null;
+  const [id, name, composeProject] = fields as [string, string, string];
+  if (!/^[a-f0-9]{12,64}$/.test(id)) return null;
+  if (!composeProject.startsWith("task-")) return "unrelated";
+  const taskId = composeProject.slice("task-".length);
+  if (!isSafeHostTaskId(taskId) || taskId !== taskId.toLowerCase()) return null;
+  if (name !== `${composeProject}_default`) return null;
+  return { id, name, composeProject, taskId };
+}
+
+function parseCandidates(stdout: string): ComposeNetworkCandidate[] | null {
+  const candidates: ComposeNetworkCandidate[] = [];
+  const ids = new Set<string>();
+  for (const line of stdout.split(/\r?\n/)) {
+    if (line.length === 0) continue;
+    const candidate = parseCandidate(line);
+    if (candidate === "unrelated") continue;
+    if (candidate === null || ids.has(candidate.id)) return null;
+    ids.add(candidate.id);
+    candidates.push(candidate);
+  }
+  return candidates;
+}
+
+function taskOwnsReclaimableNetwork(
+  task: HostTask | null,
+  candidate: ComposeNetworkCandidate,
+): boolean {
+  if (
+    task === null ||
+    task.taskId !== candidate.taskId ||
+    (task.environmentProvider !== null &&
+      task.environmentProvider !== "docker-compose") ||
+    (task.statusMirror !== "error" &&
+      task.statusMirror !== "stopped" &&
+      !(typeof task.statusMirror === "string" && isTerminal(task.statusMirror)))
+  ) {
+    return false;
+  }
+  if (task.composeProject === candidate.composeProject) return true;
+  if (!task.environmentLocator) return false;
+  try {
+    const locator = parseTaskEnvironmentLocator(task.environmentLocator);
+    if (
+      locator.schemaVersion !== 1 ||
+      locator.provider !== "docker-compose" ||
+      !locator.value ||
+      typeof locator.value !== "object" ||
+      Array.isArray(locator.value)
+    ) {
+      return false;
+    }
+    const value = locator.value as Record<string, unknown>;
+    return (
+      value.schemaVersion === 2 &&
+      value.taskId === candidate.taskId &&
+      value.composeProject === candidate.composeProject &&
+      value.containerName === `${candidate.composeProject}-app-1`
+    );
+  } catch {
+    return false;
+  }
+}
+
+function inspectedEmptyNetwork(
+  stdout: string,
+  candidate: ComposeNetworkCandidate,
+): { fullId: string } | null {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(stdout);
+  } catch {
+    return null;
+  }
+  if (!Array.isArray(parsed) || parsed.length !== 1) return null;
+  const network = parsed[0];
+  if (!network || typeof network !== "object" || Array.isArray(network)) {
+    return null;
+  }
+  const record = network as Record<string, unknown>;
+  const labels = record.Labels;
+  const containers = record.Containers;
+  if (
+    typeof record.Id !== "string" ||
+    !/^[a-f0-9]{64}$/.test(record.Id) ||
+    !record.Id.startsWith(candidate.id) ||
+    record.Name !== candidate.name ||
+    record.Driver !== "bridge" ||
+    record.Scope !== "local" ||
+    !labels ||
+    typeof labels !== "object" ||
+    Array.isArray(labels) ||
+    (labels as Record<string, unknown>)[COMPOSE_PROJECT_LABEL] !==
+      candidate.composeProject ||
+    !containers ||
+    typeof containers !== "object" ||
+    Array.isArray(containers) ||
+    Object.keys(containers).length !== 0
+  ) {
+    return null;
+  }
+  return { fullId: record.Id };
+}
+
+async function reclaimCandidate(
+  candidate: ComposeNetworkCandidate,
+  deps: ComposeNetworkRecoveryDeps,
+): Promise<boolean> {
+  if (!taskOwnsReclaimableNetwork(deps.task(candidate.taskId), candidate)) {
+    return false;
+  }
+  const inspected = await deps.docker(
+    ["network", "inspect", candidate.id],
+    {
+      timeoutMs: DOCKER_TIMEOUT_MS,
+      maxOutputBytes: MAX_NETWORK_INSPECT_BYTES,
+    },
+  );
+  if (inspected.status !== 0 || inspected.outputTruncated) return false;
+  const empty = inspectedEmptyNetwork(inspected.stdout, candidate);
+  if (empty === null) return false;
+
+  // `.Containers` is the network's own endpoint inventory. Independently ask
+  // Docker's all-container inventory as a second positive emptiness proof.
+  const attached = await deps.docker(
+    ["ps", "-aq", "--filter", `network=${empty.fullId}`],
+    {
+      timeoutMs: DOCKER_TIMEOUT_MS,
+      maxOutputBytes: MAX_NETWORK_INSPECT_BYTES,
+    },
+  );
+  if (
+    attached.status !== 0 ||
+    attached.outputTruncated ||
+    attached.stdout.trim().length !== 0
+  ) {
+    return false;
+  }
+
+  const removed = await deps.docker(["network", "rm", empty.fullId], {
+    timeoutMs: DOCKER_TIMEOUT_MS,
+    maxOutputBytes: MAX_NETWORK_INSPECT_BYTES,
+  });
+  return removed.status === 0 && !removed.outputTruncated;
+}
+
+/**
+ * Remove only positively-owned, empty task networks. This is best-effort host
+ * hygiene: an unavailable inventory never blocks a task that may still fit in
+ * Docker's pool, and it never authorizes deletion.
+ */
+export async function reclaimUnusedUaiComposeNetworks(
+  lifecycle: ComposeNetworkLifecycle,
+  deps: ComposeNetworkRecoveryDeps = defaultDeps,
+): Promise<ComposeNetworkRecoveryResult> {
+  const listed = await deps.docker(
+    [
+      "network",
+      "ls",
+      "--filter",
+      `label=${COMPOSE_PROJECT_LABEL}`,
+      "--format",
+      NETWORK_LIST_FORMAT,
+    ],
+    {
+      timeoutMs: DOCKER_TIMEOUT_MS,
+      maxOutputBytes: MAX_NETWORK_LIST_BYTES,
+    },
+  );
+  if (listed.status !== 0 || listed.outputTruncated) {
+    return { inventory: "unavailable", candidates: 0, removed: 0 };
+  }
+  const candidates = parseCandidates(listed.stdout);
+  if (candidates === null) {
+    return { inventory: "invalid", candidates: 0, removed: 0 };
+  }
+
+  let removed = 0;
+  for (const candidate of candidates) {
+    // Avoid queueing behind a live start merely to rediscover in-slot that it
+    // is not reclaimable. This observation grants no authority; the complete
+    // ownership/status check is repeated after the lifecycle slot is held.
+    if (!taskOwnsReclaimableNetwork(deps.task(candidate.taskId), candidate)) {
+      continue;
+    }
+    await lifecycle.runTaskLifecycle(candidate.taskId, async () => {
+      // The trusted row and Docker evidence are deliberately read only after
+      // entering the candidate task's lifecycle slot.
+      if (await reclaimCandidate(candidate, deps)) removed += 1;
+    });
+  }
+  return { inventory: "complete", candidates: candidates.length, removed };
+}

package/lib/orchestrator.ts

@@ -202,7 +202,12 @@ import {
   rememberLeasedEngineRuntime,
 } from "./credential-cleanup-inventory";
 import { leasedMcpAclEntries } from "./credential-consumers/mcp";
-import { ENGINE_CREDENTIAL_FILES, ENGINE_ENV_CREDENTIAL_KEYS } from "../src/cloud-credentials";
+import {
+  CREDENTIAL_FREE_KINDS,
+  ENGINE_ENV_CREDENTIAL_KEYS,
+  LEASED_ENGINE_KINDS,
+  MANAGED_ENGINE_KIND,
+} from "../src/cloud-credentials";
 import { clearTaskGatewayAcl, setupMcpTaskConfig } from "./mcp-gateway";
 import {
   reactivateTaskGatewayTask,
@@ -232,6 +237,7 @@ import {
   MAX_AGENT_ID_CHARS,
   MAX_SECRETARY_DISPATCH_ID_CHARS,
   SECRETARY_TYPED_DISPATCH_PROTOCOL_FEATURE,
+  isBuiltInAstronaut,
 } from "../src/protocol";
 import {
   isEnvironmentTransportProvider,
@@ -249,6 +255,10 @@ export type HostEventSubscriber = (event: HostEvent) => void;
 const SECRETARY_SESSION_ATTACH_KEY = "secretary-normal-tools-v1";
 const RESTRICTED_SECRETARY_SESSION_ATTACH_KEY =
   "secretary-communicator-v1";
+// ADR-157: the built-in Astronaut's runner was launched without native
+// subagents. Its own generation keeps a normal-tools runner (or an Astronaut
+// launched before the block) from ever being attached in its place.
+const ASTRONAUT_SESSION_ATTACH_KEY = "astronaut-no-subagents-v1";
 
 // ---------------------------------------------------------------------------
 // Channel — one task's live conversation.
@@ -554,14 +564,6 @@ const LEASED_CREDENTIAL_BLANKS: Readonly<Record<string, string>> = Object.freeze
     [...new Set(Object.values(ENGINE_ENV_CREDENTIAL_KEYS).flat())].map((name) => [name, ""]),
   ),
 );
-/** ADR-128: the Managed Engine. It needs no AI account (it runs on Uai's
- *  gateway), but its agent's task token is its bearer: on a leased task its
- *  launches are admitted as that token (ADR-154 §6). */
-const MANAGED_ENGINE_KIND = "uai";
-/** ADR-154 §10: kinds whose agents carry no credential at all; every other
- *  kind outside the leased lanes (Kimi) stays down on a leased task until
- *  its lane exists. */
-const CREDENTIAL_FREE_KINDS: ReadonlySet<string> = new Set(["mock"]);
 /** ADR-154 §8: how soon a failed rewrite of a task's account homes is tried
  *  again. */
 const LEASED_SYNC_RETRY_MS = 30_000;
@@ -634,11 +636,6 @@ function sameLeasedIdentity(a: LeasedIdentity, b: LeasedIdentity): boolean {
   return a.subject === b.subject && a.runEpoch === b.runEpoch;
 }
 
-/** The engine kinds whose agents run on an AI account from the lease. */
-const LEASED_ENGINE_KINDS: ReadonlySet<string> = new Set([
-  ...Object.keys(ENGINE_ENV_CREDENTIAL_KEYS),
-  ...Object.keys(ENGINE_CREDENTIAL_FILES),
-]);
 /** A burned respawn budget resets after this quiet period (see reconcile). */
 const RESPAWN_COOLDOWN_MS = 10 * 60_000;
 /** ADR-053: gap between browser-install retries. Ensures fire every couple of
@@ -2591,11 +2588,22 @@ export class Orchestrator {
     }
   }
 
-  /** Reserved seam for a future explicit restricted-role control. */
+  /** The engine-enforced launch profile for one agent, if any. */
   private executionProfileFor(
-    _channel: Channel,
-    _agentId: string,
-  ): "communicator" | undefined {
+    channel: Channel,
+    agentId: string,
+  ): "communicator" | "astronaut" | undefined {
+    // ADR-157: the built-in Astronaut keeps normal tools but runs without
+    // native subagents, so every helper it uses is an accounted crew agent.
+    // The adapter factory refuses an engine that cannot enforce that.
+    if (
+      isBuiltInAstronaut(
+        channel,
+        channel.roster.find((agent) => agent.id === agentId),
+      )
+    ) {
+      return "astronaut";
+    }
     // Secretary is an organisational role, not a sandbox. The communicator
     // profile remains implemented by adapters for a future explicit opt-in,
     // but no task gets tool denial merely by selecting Secretary mode.
@@ -2611,18 +2619,22 @@ export class Orchestrator {
     // The restricted profile is dormant today, but giving it the normal-tools
     // generation would make a future opt-out able to attach a runner launched
     // under tool denial.
+    const profile = this.executionProfileFor(channel, agent.id);
     const policy = this.isSecretary(channel, agent.id)
-      ? this.executionProfileFor(channel, agent.id) === "communicator"
+      ? profile === "communicator"
         ? RESTRICTED_SECRETARY_SESSION_ATTACH_KEY
-        : SECRETARY_SESSION_ATTACH_KEY
+        : profile === "astronaut"
+          ? ASTRONAUT_SESSION_ATTACH_KEY
+          : SECRETARY_SESSION_ATTACH_KEY
       : undefined;
     const model = agent.model ?? "";
     const effort = agent.effort ?? "";
+    const generation = agent.tokenGeneration ?? "";
     // Preserve legacy null/policy-only attachment for agents that choose no
     // launch flags. Explicit model/effort gets a stable key so a host restart
     // cannot attach a runner created under different settings.
     const envMode = hostTaskEnvMode(task);
-    if (envMode === "baked" && !model && !effort) return policy;
+    if (envMode === "baked" && !model && !effort && !generation) return policy;
     return JSON.stringify([
       envMode === "baked" ? "roster-launch-v1" : "roster-launch-v2",
       ...(envMode === "loader" ? [envMode] : []),
@@ -2630,6 +2642,10 @@ export class Orchestrator {
       model,
       effort,
       policy ?? "",
+      // ADR-157 §3: a runner keeps the token it was launched with, so one
+      // launched for an earlier agent under this handle never attaches to a
+      // later one. Absent without a generation, so no existing key changes.
+      ...(generation ? [generation] : []),
     ]);
   }
 
@@ -2640,9 +2656,11 @@ export class Orchestrator {
   }
 
   private isPromptLevelSecretary(channel: Channel, agentId: string): boolean {
+    // The Astronaut profile only removes native subagents; the Astronaut is still
+    // a normal-tools, prompt-level Secretary (CLI dispatch, its own token).
     return (
       this.isSecretary(channel, agentId) &&
-      this.executionProfileFor(channel, agentId) === undefined
+      this.executionProfileFor(channel, agentId) !== "communicator"
     );
   }
 
@@ -6435,6 +6453,12 @@ function rosterLaunchChangeReason(
   if (previous.kind !== next.kind) changed.push("engine");
   if ((previous.model ?? "") !== (next.model ?? "")) changed.push("model");
   if ((previous.effort ?? "") !== (next.effort ?? "")) changed.push("effort");
+  // ADR-157 §3: the session holds a token minted for its generation, so a new
+  // one is a new agent under the handle (or one an older cloud release lost),
+  // and only a fresh launch carries a token the cloud accepts.
+  if ((previous.tokenGeneration ?? "") !== (next.tokenGeneration ?? "")) {
+    changed.push("token generation");
+  }
   return changed.length > 0 ? `${changed.join("/")} change` : null;
 }
 
@@ -6821,6 +6845,35 @@ export function buildSystemPreamble(
             'An epoch-ms `{"__uai":"input","ts":…}` line precedes each',
             "unchanged CLI frame, so the adjacent pair identifies a wake input.",
           ];
+  // ADR-157: the built-in Astronaut, holding tasks.agents.manage, runs its own
+  // crew. The cloud refuses the same commands from anyone else, including a
+  // Secretary persona that holds the grant. It always runs under the Astronaut
+  // profile (§7), so its tools are not an ordinary Secretary's.
+  const isAstronaut = isBuiltInAstronaut({ mode, secretaryAgentId }, agent);
+  const crewBrief =
+    isAstronaut && (agent.permissions ?? []).includes("tasks.agents.manage")
+      ? [
+          "## Your crew",
+          "",
+          "You choose this task's crew. `node " + CONTAINER_CLI_PATH + " crew list` shows the",
+          "personas you can hire, the engines and models this task can run (with the",
+          "managed engine's prices), the plan's room, and the current roster. Change it",
+          "one agent at a time, always with a reason the humans will read:",
+          "- `crew add <personaId> [--as <handle>] [--engine <kind>] [--model <m>] [--effort <e>] --why \"…\"`",
+          "- `crew model @agent [--engine <kind>] [--model <m>] [--effort <e>] --why \"…\"`",
+          "  (at least one of the three; `default` as the model or effort clears it to",
+          "  the engine's own default)",
+          "- `crew remove @agent --why \"…\"`",
+          "Use the smallest crew the job needs, often none: do small work yourself and",
+          "hire only when parallel work or a different skill or model pays for itself.",
+          "A new agent is idle until you `dispatch` to it, so brief it then. Remove an",
+          "agent when its part is done; its handle is not reused, so hiring that",
+          "persona again gives it a new one. A model change restarts that agent and drops",
+          "its prompt cache, so change models between steps, not mid-step. Your own",
+          "engine and model are the human's choice; you cannot change or remove yourself.",
+          "",
+        ]
+      : [];
   const secretaryRoleBrief = isSecretary
     ? [
         "## Secretary role",
@@ -6831,9 +6884,20 @@ export function buildSystemPreamble(
         "Synthesize the",
         "crew's replies for the human instead of forwarding a pile of raw updates.",
         "",
-        "Your Secretary role is prompt-guided, not tool-restricted. You have the",
-        "same normal tools, approved MCP connections, model choice, and persona",
-        "permissions as any other task agent. Your default job is to communicate,",
+        ...(isAstronaut
+          ? [
+              "Your role is prompt-guided. You have the normal tools, approved MCP",
+              "connections and persona permissions of any task agent, except native",
+              "subagents: helpers your engine starts on its own would work outside the",
+              "crew, unpriced and unseen by the humans, so they are switched off. Work",
+              "for another agent goes to a crew agent through `dispatch`. Your default",
+              "job is to communicate,",
+            ]
+          : [
+              "Your Secretary role is prompt-guided, not tool-restricted. You have the",
+              "same normal tools, approved MCP connections, model choice, and persona",
+              "permissions as any other task agent. Your default job is to communicate,",
+            ]),
         "coordinate, and dispatch implementation work rather than doing it yourself.",
         "If the human explicitly asks YOU to make a change, you may use those tools",
         "and do it directly; otherwise hand mutations to a crew agent.",
@@ -7072,6 +7136,7 @@ export function buildSystemPreamble(
     ...sessionInboxBrief,
     ...(sessionInboxBrief.length > 0 ? [""] : []),
     ...secretaryRoleBrief,
+    ...crewBrief,
     ...channelConventionsBrief,
     ...(replyCardBrief.length > 0 ? ["", ...replyCardBrief] : []),
     ...checkInTranscriptBrief,

package/lib/standard-image.ts

@@ -714,6 +714,24 @@ export function standardImageVolumeMaintenanceCommandForTest(
     `ensure_real_dir "$node_root" node-root; ` +
     `ensure_real_dir "$shims_root" shims-root; ` +
     `ensure_real_dir "$corepack_root" corepack-root; ` +
+    // Legacy images could seed individual shims as root even though the
+    // directory itself was later repaired. asdf 0.14 then prints permission
+    // errors while reshim quietly leaves the old executable behind; task
+    // materialization can appear successful but the next CLI launch is stale
+    // or non-executable. The trusted root maintenance transaction repairs only
+    // the flat, regular-file shim set before dropping to node for every asdf
+    // mutation. Anything else is ambiguous volume content and fails closed.
+    `repair_shim_metadata() { ` +
+    `unsafe_shim_entry="$(/usr/bin/find "$shims_root" -xdev -mindepth 1 ` +
+    `-maxdepth 1 ! -type f -print -quit)"; ` +
+    `[ -z "$unsafe_shim_entry" ] || fail unsafe-shim-entry; ` +
+    `/usr/bin/find "$shims_root" -xdev -mindepth 1 -maxdepth 1 -type f ` +
+    `-exec /usr/bin/chown node:node -- {} + ` +
+    `|| fail repair-shim-owner; ` +
+    `/usr/bin/find "$shims_root" -xdev -mindepth 1 -maxdepth 1 -type f ` +
+    `-exec /usr/bin/chmod 0755 -- {} + ` +
+    `|| fail repair-shim-mode; }; ` +
+    `repair_shim_metadata; ` +
     `candidate_is_safe() { ` +
     `lexical_candidate="$(/usr/bin/realpath -m -s -- "$candidate")" ` +
     `|| return 1; [ "$lexical_candidate" = "$node_root/$default_node" ] ` +

package/lib/task-token.ts

@@ -11,6 +11,8 @@ export interface TaskTokenPayload {
   userId: string;
   permissions: string[];
   agentId?: string;
+  /** ADR-157 §3: the agent's roster generation; the cloud requires it to match. */
+  generation?: string;
 }
 
 const PREFIX = "uai_";
@@ -31,6 +33,7 @@ export function signTaskToken(payload: TaskTokenPayload, secret: string): string
         u: payload.userId,
         p: payload.permissions,
         ...(payload.agentId ? { a: payload.agentId } : {}),
+        ...(payload.generation ? { g: payload.generation } : {}),
         iat: Math.floor(Date.now() / 1000),
       }),
     ),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.9.154",
+  "version": "0.9.156",
   "description": "Uai host — runs ephemeral AI tasks in containers on a machine you control.",
   "license": "MIT",
   "author": "Uai Tech <team@runuai.com>",

package/scripts/agent/task-up.sh

@@ -2607,8 +2607,27 @@ if [ "$TASK_RUNTIME_MODE" = "apple-container" ]; then
   fi
 else
   step "COMPOSE_UP_FAILED" "docker compose up -d"
-  printf '%s\n' "$compose_env_override" | docker compose -p "$compose_project" \
-    -f "$task_uai_dir/docker-compose.yml" -f - up -d --no-build >/dev/null
+  compose_up_error=""
+  # Keep the diagnostic in memory only, but bound it: a broken plugin or
+  # daemon must not make task-up retain an arbitrarily large stderr stream.
+  # Docker's allocation error is emitted at the end of Compose's failure.
+  if ! compose_up_error=$(printf '%s\n' "$compose_env_override" \
+    | docker compose -p "$compose_project" \
+      -f "$task_uai_dir/docker-compose.yml" -f - up -d --no-build \
+      2>&1 >/dev/null | tail -c 65536); then
+    [ -z "$compose_up_error" ] || printf '%s\n' "$compose_up_error" >&2
+    require_docker_after_failed_step "docker compose up -d"
+    if printf '%s\n' "$compose_up_error" \
+      | grep -Fq 'all predefined address pools have been fully subnetted'; then
+      emit_err "COMPOSE_UP_FAILED" \
+        "Docker has no subnet left for this task. Uai already reclaimed every empty task network it could prove safe. Close an unused stopped/error task, or enlarge Docker's non-overlapping default address pools and restart Docker, then press Resume." \
+        "docker compose up -d"
+    fi
+    emit_err "COMPOSE_UP_FAILED" \
+      "Uai could not start this task's Docker Compose stack. Fix the Docker error above, then press Resume." \
+      "docker compose up -d"
+  fi
+  unset compose_up_error
 fi
 
 # Rendered YAML is not runtime evidence: Compose could reuse unexpected state,

package/src/cloud-credentials.ts

@@ -286,6 +286,31 @@ export const ENGINE_CREDENTIAL_FILES: Readonly<Record<string, readonly string[]>
   opencode: ["auth.json"],
 };
 
+/** The engine kinds whose agents run on an AI account from the lease. */
+export const LEASED_ENGINE_KINDS: ReadonlySet<string> = new Set([
+  ...Object.keys(ENGINE_ENV_CREDENTIAL_KEYS),
+  ...Object.keys(ENGINE_CREDENTIAL_FILES),
+]);
+
+/** ADR-128: the Managed Engine. It needs no AI account (it runs on Uai's
+ *  gateway), but its agent's task token is its bearer: on a leased task its
+ *  launches are admitted as that token (ADR-154 §6). */
+export const MANAGED_ENGINE_KIND = "uai";
+
+/** ADR-154 §10: kinds whose agents carry no credential at all; every other
+ *  kind outside the leased lanes (Kimi) stays down on a leased task until
+ *  its lane exists. */
+export const CREDENTIAL_FREE_KINDS: ReadonlySet<string> = new Set(["mock"]);
+
+/** ADR-154 §10: every kind a task on cloud credentials can run, and so every
+ *  kind a runner on them advertises. The Managed Engine is one, though it
+ *  leases nothing. Kimi, with no lane yet, is not. */
+export const CLOUD_CREDENTIAL_KINDS: ReadonlySet<string> = new Set([
+  ...LEASED_ENGINE_KINDS,
+  MANAGED_ENGINE_KIND,
+  ...CREDENTIAL_FREE_KINDS,
+]);
+
 interface LeasedValueBase {
   v: 1;
   part: "lease";

package/src/index.ts

@@ -126,6 +126,7 @@ import {
   waitForContainerRuntimeOperational,
 } from "../lib/container-runtime";
 import { vnodeAdmissionProblem } from "../lib/vnode-pressure";
+import { reclaimUnusedUaiComposeNetworks } from "../lib/compose-network-recovery";
 import {
   machineTasksEnabled,
   provisionTaskEnvironment,
@@ -616,6 +617,41 @@ async function taskUpOn(
       );
     }
   }
+  // Every local Docker task consumes one daemon address-pool subnet. A task
+  // that failed after Compose created its network can retain an empty subnet
+  // while it waits for Resume. Reclaim only networks whose trusted host row,
+  // exact Docker identity and two empty-container inventories all agree. The
+  // sweep runs before this task's lifecycle slot so concurrent failed starts
+  // can never deadlock while trying to inspect one another.
+  if (
+    !sidecarMode() &&
+    !machineTasksEnabled() &&
+    pinnedContainerRuntimeProvider() === "docker"
+  ) {
+    try {
+      const networkRecovery = await reclaimUnusedUaiComposeNetworks(
+        orchestrator,
+      );
+      if (networkRecovery.removed > 0) {
+        console.warn(
+          `[host-agent] reclaimed ${String(networkRecovery.removed)} empty UAI task ` +
+            `network(s) before starting ${input.task.id}`,
+        );
+      } else if (networkRecovery.inventory === "invalid") {
+        console.warn(
+          "[host-agent] skipped task-network recovery because Docker returned an invalid network inventory",
+        );
+      }
+    } catch (error) {
+      // Best-effort capacity recovery must not block a task when Docker still
+      // has room. `docker compose up` remains the authoritative allocation.
+      console.warn(
+        `[host-agent] task-network recovery was unavailable: ${
+          error instanceof Error ? error.message : String(error)
+        }`,
+      );
+    }
+  }
   return orchestrator.runTaskLifecycle(input.task.id, releasingHold(cloud, async () => {
     // A direct duplicate teardown may still be draining operations that
     // target this task's stable compose/container names. Never recreate

package/src/main.ts

@@ -92,8 +92,7 @@ import { cancelMcpCapture, completeMcpCapture, probeMcpCapture } from "../lib/mc
 import { captureGithub, mintSsh, readGithubRevision, revokeGithub } from "../lib/person-capture";
 import { handleMcpOp } from "../lib/mcp-connections";
 import {
-  ENGINE_CREDENTIAL_FILES,
-  ENGINE_ENV_CREDENTIAL_KEYS,
+  CLOUD_CREDENTIAL_KINDS,
   HOST_CLOUD_CREDENTIALS_FEATURE,
   parseCredentialsActivateResultFrame,
   runEpochFromWire,
@@ -301,6 +300,7 @@ import {
   HOST_ENGINE_DISCONNECT_PROTOCOL_FEATURE,
   HOST_ENGINE_LOGIN_PROTOCOL_FEATURE,
   LIVE_ROSTER_EDIT_PROTOCOL_FEATURE,
+  AGENT_TOKEN_GENERATION_PROTOCOL_FEATURE,
   isEngineAccountScope,
   HOST_LOGS_PROTOCOL_FEATURE,
   HOST_TASK_INVENTORY_PROTOCOL_FEATURE,
@@ -703,10 +703,6 @@ setCredentialsModeSource(() => credentialsActivation.mode());
  *  so the operator turning them on reaches it within minutes. */
 const CREDENTIALS_ACTIVATION_RETRY_MS = 5 * 60_000;
 const CREDENTIALS_ACTIVATION_ANSWER_MS = 60_000;
-const LEASED_ENGINE_KINDS: ReadonlySet<string> = new Set([
-  ...Object.keys(ENGINE_ENV_CREDENTIAL_KEYS),
-  ...Object.keys(ENGINE_CREDENTIAL_FILES),
-]);
 // Started here, first fired long after the bridge's state exists.
 const credentialsActivationTimer = setInterval(() => {
   if (stopping || !credentialFramesReady) return;
@@ -1398,6 +1394,7 @@ function buildCapabilities(): HostCapabilities {
       HOST_ENGINE_ACCOUNT_MANAGE_PROTOCOL_FEATURE,
       HOST_ENGINE_DISCONNECT_PROTOCOL_FEATURE,
       LIVE_ROSTER_EDIT_PROTOCOL_FEATURE,
+      AGENT_TOKEN_GENERATION_PROTOCOL_FEATURE,
       // The echo adapter cannot execute the in-task CLI. Advertising typed
       // dispatch in mock mode would let the composer create a Secretary that
       // has no way to wake crew.
@@ -1899,10 +1896,11 @@ function flushStoppedTaskStatuses(socket: WebSocket | null = ws): void {
 // ADR-131 D3: a stored account (any scope) makes a kind advertisable even
 // when the host's own credential is absent — see hasStoredEngineAccounts.
 setAdvertisementFallback((kind) => hasStoredEngineAccounts(kind));
-// ADR-154: on cloud credentials the runner holds none of its own, so a kind
-// is advertised when the cloud can lease an account for it (Kimi, with no
-// lane yet, is not), whatever this process's env says.
-setLeasedAdvertisement(() => (credentialsMode() === "active" ? LEASED_ENGINE_KINDS : null));
+// ADR-154 §10: on cloud credentials the runner holds none of its own, so it
+// advertises the kinds a leased task can run, whatever this process's env
+// says: the leased lanes and the Managed Engine, which leases nothing (Kimi,
+// with no lane yet, is left out).
+setLeasedAdvertisement(() => (credentialsMode() === "active" ? CLOUD_CREDENTIAL_KINDS : null));
 onRegistryChange(() => sendCapabilities());
 onContainerRuntimeChange((next, previous) => {
   if (stopping) return;
@@ -5418,6 +5416,12 @@ function expectTaskAgents(value: unknown): TaskAgent[] {
       const perms = row.permissions.filter((p): p is string => typeof p === "string");
       if (perms.length > 0) out.permissions = perms;
     }
+    // ADR-157: the built-in Astronaut's marker, set only by the cloud.
+    if (row.builtIn === "astronaut") out.builtIn = "astronaut";
+    // ADR-157 §3: the generation its task token must carry.
+    if (typeof row.tokenGeneration === "string" && row.tokenGeneration.length > 0) {
+      out.tokenGeneration = row.tokenGeneration;
+    }
     return out;
   });
 }

package/src/protocol.ts

@@ -82,6 +82,14 @@ export type HostCommandResult<T> =
        * An unknown FIELD is ignored by old readers; an unknown CODE is not.
        */
       origin?: "cloud";
+      /**
+       * With `origin: "cloud"`: the protocol feature the command's payload
+       * needs and this runner does not advertise, so the bridge never sent it
+       * (ADR-157 §3: a roster with token generations needs
+       * `agent-token-generation-v1`). Additive for the same reason as
+       * `origin`; never set by a host.
+       */
+      requiresFeature?: string;
     };
 
 /** Capability ids shared by host advertisement and fail-closed cloud gates. */
@@ -156,6 +164,12 @@ export const HOST_ENGINE_ACCOUNT_SCOPES_PROTOCOL_FEATURE =
  * unrelated respawn and never stops a removed one, so the cloud refuses to
  * edit or remove a running task's agents on it. */
 export const LIVE_ROSTER_EDIT_PROTOCOL_FEATURE = "live-roster-edit-v1";
+/** ADR-157 §3: the host signs an agent's `tokenGeneration` into its task token
+ * (claim `g`). The cloud stamps a fresh generation on an agent that joins a
+ * running task only on a host advertising this, and refuses a token whose
+ * generation is not its roster entry's, so a token minted for an earlier agent
+ * under the same handle stays dead. */
+export const AGENT_TOKEN_GENERATION_PROTOCOL_FEATURE = "agent-token-generation-v1";
 /** ADR-153 declarations + owner bindings. Advertising this means the host
  * understands every additive env frame field, persists bindings separately
  * from values, and reports immutable repository schema observations. Keep it
@@ -2956,6 +2970,29 @@ export const MAX_HOST_TASK_INVENTORY_TASK_ID_CHARS = 128;
 export const ENROLLMENT_REPLAY_PROTOCOL_HEADER = "x-uai-enrollment-replay";
 export const ENROLLMENT_REPLAY_PROTOCOL_VERSION = "same-host-v1";
 export const COMMUNICATOR_EXECUTION_PROFILE = "communicator";
+/**
+ * ADR-157: the built-in Astronaut. An Astronaut task has exactly one lead agent with
+ * this id, marked `builtIn: "astronaut"` by the cloud when it builds the entry;
+ * no client may send the marker. The lead runs under the `astronaut` execution
+ * profile: normal tools, but no native subagents (Claude's Agent/Task, Codex's
+ * multi-agent), so every helper it uses is an accounted crew agent.
+ */
+export const ASTRONAUT_AGENT_ID = "astronaut";
+export const ASTRONAUT_BUILT_IN = "astronaut";
+export const ASTRONAUT_EXECUTION_PROFILE = "astronaut";
+
+/** Whether `agent` is this task's built-in Astronaut (ADR-157 §1). */
+export function isBuiltInAstronaut(
+  task: { mode?: string | null; secretaryAgentId?: string | null },
+  agent: { id: string; builtIn?: string | null } | null | undefined,
+): boolean {
+  return (
+    task.mode === "secretary" &&
+    task.secretaryAgentId === ASTRONAUT_AGENT_ID &&
+    agent?.id === ASTRONAUT_AGENT_ID &&
+    agent.builtIn === ASTRONAUT_BUILT_IN
+  );
+}
 export const MAX_AGENT_ID_CHARS = 128;
 export const MAX_SECRETARY_DISPATCH_RECIPIENTS = 16;
 export const MAX_SECRETARY_DISPATCH_INSTRUCTION_CHARS = 8_000;
@@ -3023,6 +3060,11 @@ export interface TaskAgent {
   }>;
   /** ADR-048: the source persona's flat permission list for the `uai` CLI. */
   permissions?: string[];
+  /** ADR-157: set by the cloud on the built-in Astronaut only. */
+  builtIn?: "astronaut";
+  /** ADR-157 §3: this agent's token generation, stamped by the cloud when it
+   *  joined the running task; signed into its task token as `g`. */
+  tokenGeneration?: string;
 }
 
 export type ContainerRuntimePreference = "auto" | "docker" | "apple-container";