@runuai/host 0.9.166 → 0.9.168

package/lib/agents/grok.ts

@@ -44,6 +44,7 @@ import {
   spawnEnvironmentProcess,
   type AgentEnvironmentProcess,
 } from "./proc";
+import { rateLimitErrorUsage } from "./rate-limit";
 import { register } from "./registry";
 import { GROK_MODELS } from "../../src/engine-models";
 import type {
@@ -58,10 +59,9 @@ import type {
 const GROK_BIN = "/home/node/.grok/bin/grok";
 export const GROK_LOADER_LOGIN_ENV = "0";
 
-// `grok models` lists what the account can run. grok-4.5 is the current
-// default; UPDATE WHEN xAI CHANGES the lineup.
-// The model list is host-agent/src/engine-models.ts (GROK_MODELS).
-const GROK_DEFAULT_MODEL = "grok-4.5";
+// Static fallback catalog verified against `grok models`; keep the shared list
+// in host-agent/src/engine-models.ts (GROK_MODELS) current with the pinned CLI.
+const GROK_DEFAULT_MODEL = "grok-4.7";
 // Grok has no per-invocation reasoning-effort flag.
 const GROK_EFFORTS: string[] = [];
 
@@ -313,10 +313,23 @@ export class GrokSession implements AgentSession {
           this.emit({ type: "error", message: `grok spawn failed: ${spawnErr}` });
         } else if (code !== 0) {
           const tail = stderr.trim().slice(-500);
-          this.emit({
-            type: "error",
-            message: `grok exited ${code ?? "null"}${tail ? `: ${tail}` : ""}`,
-          });
+          const message = `grok exited ${code ?? "null"}${tail ? `: ${tail}` : ""}`;
+          // Same path as Claude/Codex/OpenCode: a usage-cap / 429 error emits
+          // account_usage (source error-text) so the orchestrator can rotate.
+          const accountUsage = rateLimitErrorUsage(message);
+          if (accountUsage) {
+            this.emit({ type: "account_usage", usage: accountUsage });
+            this.emit({
+              type: "error",
+              message,
+              retryable: "rate_limit",
+              ...(accountUsage.resetsAt === undefined
+                ? {}
+                : { resetsAt: accountUsage.resetsAt }),
+            });
+          } else {
+            this.emit({ type: "error", message });
+          }
         }
         // Finalize the streamed message (no-op text if the turn produced none).
         if (sawText) this.emit({ type: "message_complete", text: acc });

package/lib/agents/machine-durable.ts

@@ -1,3 +1,5 @@
+import { StringDecoder } from "node:string_decoder";
+import { agentOutputSource } from "./output-source";
 /**
  * ADR-121 + ADR-061: durable agent sessions for MACHINE-backed tasks.
  *
@@ -139,6 +141,8 @@ export class MachineDurableProcess implements LineTransport {
   readonly #lineHandlers = new Set<LineHandler>();
   readonly #exitHandlers = new Set<ExitHandler>();
 
+  readonly #decoder = new StringDecoder("utf8");
+  #lineOffset = 0;
   #offset: number;
   #lineBuf = "";
   #stderrBuf = "";
@@ -166,6 +170,7 @@ export class MachineDurableProcess implements LineTransport {
     this.#outboxPath = posix.join(opts.sessionDir, "outbox.jsonl");
     this.#inboxPath = posix.join(opts.sessionDir, "inbox.jsonl");
     this.#offset = opts.initialOutboxOffset ?? 0;
+    this.#lineOffset = this.#offset;
     this.#onOffsetAdvance = opts.onOffsetAdvance ?? null;
     this.#onCloseRequested = opts.onCloseRequested ?? null;
     this.#debug =
@@ -248,11 +253,11 @@ export class MachineDurableProcess implements LineTransport {
           if (generation !== this.#tailGeneration) break;
           const text = Buffer.from(chunk);
           this.#offset += text.byteLength;
-          this.#lineBuf += text.toString("utf8");
+          this.#lineBuf += this.#decoder.write(text);
           this.#drainLines();
           if (this.#onOffsetAdvance && !this.#closed) {
             try {
-              this.#onOffsetAdvance(this.#offset);
+              this.#onOffsetAdvance(this.#lineOffset);
             } catch {
               // Persistence hiccup — the next batch retries larger.
             }
@@ -282,7 +287,9 @@ export class MachineDurableProcess implements LineTransport {
   #drainLines(): void {
     let nl: number;
     while ((nl = this.#lineBuf.indexOf("\n")) >= 0) {
-      const line = this.#lineBuf.slice(0, nl).trim();
+      const rawLine = this.#lineBuf.slice(0, nl);
+      this.#lineOffset += Buffer.byteLength(rawLine) + 1;
+      const line = rawLine.trim();
       this.#lineBuf = this.#lineBuf.slice(nl + 1);
       if (line.length === 0) continue;
       if (line.startsWith('{"__uai"')) {
@@ -292,7 +299,7 @@ export class MachineDurableProcess implements LineTransport {
       if (this.#debug) this.#log(`<- ${line.slice(0, 1000)}`);
       for (const handler of this.#lineHandlers) {
         try {
-          handler(line);
+          agentOutputSource.run(this.durableSessionDir + ":" + this.#lineOffset, () => handler(line));
         } catch {
           // A broken handler must not wedge the tail loop.
         }
@@ -464,7 +471,7 @@ export class MachineDurableProcess implements LineTransport {
   }
 
   get outboxOffset(): number {
-    return this.#offset;
+    return this.#lineOffset;
   }
 
   /** Stop consuming WITHOUT touching the runner (host restart in miniature). */

package/lib/agents/output-source.ts

@@ -0,0 +1,3 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+/** Stable outbox position follows adapter async work, never a timestamp. */
+export const agentOutputSource = new AsyncLocalStorage<string>();

package/lib/agents/registry.ts

@@ -144,25 +144,25 @@ export function capabilities(): AgentKindCapability[] {
         : (adapter.available?.() ?? true) || advertisementFallback(adapter.kind),
     )
     .map((adapter) => {
-    const out: AgentKindCapability = {
-      kind: adapter.kind,
-      label: adapter.label,
-      supportedModels: adapter.supportedModels(),
-      supportedEfforts: adapter.supportedEfforts(),
-    };
-    if (adapter.defaultModel !== undefined) {
-      out.defaultModel = adapter.defaultModel;
-    }
-    if (adapter.defaultEffort !== undefined) {
-      out.defaultEffort = adapter.defaultEffort;
-    }
-    if (adapter.executionProfiles && adapter.executionProfiles.length > 0) {
-      out.executionProfiles = adapter.executionProfiles.map((profile) => ({
-        ...profile,
-      }));
-    }
-    return out;
-  });
+      const out: AgentKindCapability = {
+        kind: adapter.kind,
+        label: adapter.label,
+        supportedModels: adapter.supportedModels(),
+        supportedEfforts: adapter.supportedEfforts(),
+      };
+      if (adapter.defaultModel !== undefined) {
+        out.defaultModel = adapter.defaultModel;
+      }
+      if (adapter.defaultEffort !== undefined) {
+        out.defaultEffort = adapter.defaultEffort;
+      }
+      if (adapter.executionProfiles && adapter.executionProfiles.length > 0) {
+        out.executionProfiles = adapter.executionProfiles.map((profile) => ({
+          ...profile,
+        }));
+      }
+      return out;
+    });
 }
 
 /**

package/lib/agents/transport.ts

@@ -118,6 +118,11 @@ interface DetachableTail extends LineTransport {
 
 const liveTails = new Map<string, DetachableTail>();
 
+export function durableAgentSessionId(taskId: string, agentId: string): string | undefined {
+  const tail = liveTails.get(`${taskId}:${agentId}`);
+  return tail && !tail.isClosed ? tail.durableSessionDir : undefined;
+}
+
 function claimTail<T extends DetachableTail>(key: string, proc: T): T {
   liveTails.get(key)?.detach();
   liveTails.set(key, proc);

package/lib/agents/types.ts

@@ -124,7 +124,7 @@ export interface AgentAccountUsage {
   resetsAt?: number;
   usingOverage?: boolean;
   windows: EngineUsageWindow[];
-  source: "claude-rate-limit-event" | "codex-rate-limits" | "error-text";
+  source: "claude-rate-limit-event" | "codex-rate-limits" | "error-text" | "cursor-period-usage";
   observedAt: number;
   /** Which provider capacity this reading can prove usable again. Claude emits
    * one event per named window; Codex snapshots cover every window. Internal

package/lib/agents/usage.ts

@@ -1,11 +1,12 @@
 /**
- * Shared token/cost extraction for the Claude-Code-compatible stream-json
- * `result` envelope (ADR-071 metering). Claude Code AND Cursor Agent both emit
- * this exact shape — `usage` token breakdown, an exact `total_cost_usd`, and
- * per-model `modelUsage` — so both engines share this one extractor.
+ * Shared token/cost extraction for a stream-json `result` envelope (ADR-071
+ * metering). Claude Code reports snake_case `usage` plus `total_cost_usd` and
+ * per-model `modelUsage`. cursor-agent 2026.10.x reports camelCase counts and
+ * no cost: `{inputTokens, outputTokens, cacheReadTokens, cacheWriteTokens}`.
+ * Snake_case wins when a field is present, so Claude's path is unchanged.
  *
  * Codex (app-server protocol) and Kimi/Grok (plain text streams) report no
- * token/cost data, so they have no extractor.
+ * token/cost data through this extractor.
  */
 
 import type { AgentUsage } from "./types";
@@ -18,6 +19,12 @@ function num(v: unknown): number | undefined {
   return typeof v === "number" && Number.isFinite(v) ? v : undefined;
 }
 
+/** Claude's name when it is a number, otherwise Cursor 2026.10's. */
+function firstNum(claude: unknown, cursor: unknown): number | undefined {
+  const primary = num(claude);
+  return primary !== undefined ? primary : num(cursor);
+}
+
 /** Pull AgentUsage from a `result` line, or undefined when none is reported. */
 export function extractResultUsage(
   json: Record<string, unknown>,
@@ -26,10 +33,10 @@ export function extractResultUsage(
   const models = isObj(json.modelUsage) ? Object.keys(json.modelUsage) : [];
   const usage: AgentUsage = {
     model: models.length ? models.join(", ") : undefined,
-    inputTokens: num(u.input_tokens),
-    outputTokens: num(u.output_tokens),
-    cacheReadTokens: num(u.cache_read_input_tokens),
-    cacheCreateTokens: num(u.cache_creation_input_tokens),
+    inputTokens: firstNum(u.input_tokens, u.inputTokens),
+    outputTokens: firstNum(u.output_tokens, u.outputTokens),
+    cacheReadTokens: firstNum(u.cache_read_input_tokens, u.cacheReadTokens),
+    cacheCreateTokens: firstNum(u.cache_creation_input_tokens, u.cacheWriteTokens),
     costUsd: num(json.total_cost_usd),
   };
   // Nothing usable reported → omit rather than send an empty object.

package/lib/assignment-evidence.ts

@@ -0,0 +1,93 @@
+/** Host-owned durable correlation, independent of a CLI's mutable history. */
+import { randomUUID } from "node:crypto";
+import { closeSync, fsyncSync, mkdirSync, openSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
+import type { AssignmentDelivery, AssignmentTurnEvidence } from "../src/protocol";
+
+interface State {
+  sessionId: string;
+  current: AssignmentDelivery | null;
+  active: AssignmentTurnEvidence[];
+  deliveries: string[];
+  observations: Record<string, AssignmentTurnEvidence>;
+}
+/** One journal per task/agent, in runner-private task data, never /workspace. */
+export class AssignmentEvidenceJournal {
+  constructor(private readonly path: string) {}
+  private read(sessionId: string): State {
+    let state: State;
+    try { state = JSON.parse(readFileSync(this.path, "utf8")) as State; }
+    catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
+      return { sessionId, current: null, active: [], deliveries: [], observations: {} };
+    }
+    // A replacement CLI is a new execution generation; never attach the
+    // predecessor's turn to it. Explicit redispatch can restore the assignment.
+    return state.sessionId === sessionId ? state : { sessionId, current: state.current, active: [], deliveries: [], observations: {} };
+  }
+  private write(state: State) {
+    mkdirSync(dirname(this.path), { recursive: true, mode: 0o700 });
+    const temp = this.path + "." + randomUUID();
+    const fd = openSync(temp, "wx", 0o600);
+    try { writeFileSync(fd, JSON.stringify(state)); fsyncSync(fd); } finally { closeSync(fd); }
+    renameSync(temp, this.path);
+    const dir = openSync(dirname(this.path), "r");
+    try { fsyncSync(dir); } finally { closeSync(dir); }
+  }
+  begin(input: { sessionId: string; engine: string; runEpoch: number; runtimeVersion: string | null; recipientGeneration: string | null; assignment?: AssignmentDelivery | null; replay?: boolean; leadRunId?: string | null }): (AssignmentTurnEvidence & { assignment: AssignmentDelivery | null }) | null {
+    const state = this.read(input.sessionId);
+    if (state.current && (state.current.runEpoch !== input.runEpoch || state.current.recipientGeneration !== input.recipientGeneration)) {
+      state.current = null;
+      state.active = [];
+      state.deliveries = [];
+    }
+    // Assignment id, not attempt id: a lost cloud ack must not send the same
+    // instruction twice. Old attempts retain their original provenance.
+    if (!input.replay && input.assignment && state.deliveries.includes(input.assignment.assignmentId)) return null;
+    if (input.assignment) {
+      // A replay carries its original identity without retargeting subsequent
+      // new inputs to an older assignment. Deduplication applies to cloud
+      // deliveries; an internally retained prompt is an execution retry.
+      if (!input.replay) state.current = input.assignment;
+      if (!state.deliveries.includes(input.assignment.assignmentId)) state.deliveries.push(input.assignment.assignmentId);
+    }
+    const current = input.assignment === null ? null : input.assignment ?? state.current;
+    const evidence: AssignmentTurnEvidence = {
+      turnId: randomUUID(), sessionId: input.sessionId, runEpoch: input.runEpoch,
+      assignmentId: current?.assignmentId ?? null, deliveryId: current?.deliveryId ?? null,
+      recipientGeneration: current?.recipientGeneration ?? (input.leadRunId ? input.recipientGeneration : null),
+      ...(input.leadRunId ? { leadRunId: input.leadRunId } : {}),
+      correlation: input.assignment || input.leadRunId ? "explicit" : current ? "followup" : "unknown",
+      acceptedAt: Date.now(), engine: input.engine, runtimeVersion: input.runtimeVersion,
+    };
+    // Concurrent prompts aren't assumed to execute FIFO. Without a provider
+    // turn/request join, every overlapping turn is explicitly unallocated.
+    if (state.active.length) {
+      for (const turn of state.active) { turn.assignmentId = null; turn.deliveryId = null; turn.leadRunId = null; turn.correlation = "ambiguous"; }
+      evidence.assignmentId = null; evidence.deliveryId = null; evidence.leadRunId = null; evidence.correlation = "ambiguous";
+    }
+    state.active.push(evidence);
+    this.write(state);
+    return { ...evidence, assignment: current };
+  }
+  observe(sessionId: string, sourceId: string | undefined, complete: boolean): AssignmentTurnEvidence | undefined {
+    const state = this.read(sessionId);
+    if (sourceId && state.observations[sourceId]) return state.observations[sourceId];
+    const active = state.active[0];
+    if (!active) return undefined;
+    const evidence = { ...active, ...(complete ? { endedAt: Date.now() } : {}) };
+    if (sourceId) state.observations[sourceId] = evidence;
+    if (complete) state.active.shift();
+    this.write(state);
+    return evidence;
+  }
+  failed(sessionId: string, turnId: string): void {
+    const state = this.read(sessionId);
+    const turn = state.active.find(t => t.turnId === turnId);
+    state.active = state.active.filter(t => t.turnId !== turnId);
+    // Failure before acceptance allows retry. Ambiguous sends stay unknown;
+    // never manufacture a successful execution from delivery alone.
+    if (turn?.assignmentId) state.deliveries = state.deliveries.filter(id => id !== turn.assignmentId);
+    this.write(state);
+  }
+}

package/lib/cloud-credential-leases.ts

@@ -1,3 +1,4 @@
+import { parseTaskSecretMaterial, type TaskSecretManifestEntry, type TaskSecretMaterial } from "../src/task-secrets";
 /**
  * ADR-154 task-scoped credential leases.
  *
@@ -86,7 +87,7 @@ export type LeaseGateCloseReason =
 export type CredentialCleanupReason = LeaseGateCloseReason | "lease-replaced";
 
 export interface CredentialCleanupIdentity {
-  class: "engine" | "mcp" | "github" | "ssh";
+  class: "engine" | "mcp" | "github" | "ssh" | "task-secret";
   credentialId: string;
   revision: string | null;
 }
@@ -136,6 +137,7 @@ export interface TaskStaticCredential<T extends LeasedValue> {
 
 /** A task-facing view. It contains material, but never STS credentials. */
 export interface TaskCredentialView {
+  taskSecrets?: readonly { manifest: Readonly<TaskSecretManifestEntry>; material: Readonly<TaskSecretMaterial> | null }[];
   assignment: Readonly<TaskAssignment>;
   leaseId: string;
   manifestRevision: number;
@@ -293,12 +295,13 @@ type CredentialDescriptor = {
   sessionId: string | null;
   authKind: "env" | "config-dir" | "oauth" | "token" | "none" | null;
   location: CredentialLocation | null;
+  taskSecret?: { entry: TaskSecretManifestEntry; orgId: string; taskId: string };
 };
 
 type CredentialRecord = {
   descriptor: CredentialDescriptor;
   availability: CredentialMaterialAvailability;
-  material: LeasedValue | null;
+  material: LeasedValue | TaskSecretMaterial | null;
   observedVersion: number | null;
 };
 
@@ -527,13 +530,16 @@ function manifestDescriptors(lease: TaskLeaseV1): CredentialDescriptor[] {
     ...lease.manifest.engines.map(descriptorFromEngine),
     ...lease.manifest.mcp.map(descriptorFromMcp),
   ];
+  for (const entry of lease.manifest.taskSecrets ?? []) out.push({ class: "task-secret", credentialId: entry.credentialId,
+    revision: String(entry.generation), parameter: entry.parameter, version: entry.version, sessionId: entry.sessionId,
+    authKind: null, location: null, taskSecret: { entry, orgId: lease.orgId, taskId: lease.taskId } });
   if (lease.manifest.github) out.push(descriptorFromStatic(lease.manifest.github, "github"));
   if (lease.manifest.ssh) out.push(descriptorFromStatic(lease.manifest.ssh, "ssh"));
   return out;
 }
 
 function materialMatchesDescriptor(
-  material: LeasedValue,
+  material: LeasedValue | TaskSecretMaterial,
   descriptor: CredentialDescriptor,
 ): boolean {
   if (material.class !== descriptor.class) return false;
@@ -542,7 +548,7 @@ function materialMatchesDescriptor(
   return descriptor.authKind === null;
 }
 
-function freezeMaterial<T extends LeasedValue>(material: T): Readonly<T> {
+function freezeMaterial<T extends LeasedValue | TaskSecretMaterial>(material: T): Readonly<T> {
   Object.freeze(material.location);
   if (material.class === "engine") {
     if (material.authKind === "env") Object.freeze(material.env);
@@ -628,6 +634,11 @@ function freezeView(
     manifestDigest: lease.manifestDigest,
     expiresAt,
     projectIds: Object.freeze(lease.manifest.projects.map((project) => project.projectId)),
+    ...(lease.manifest.taskSecrets?.length ? { taskSecrets: Object.freeze(lease.manifest.taskSecrets.map(manifest => {
+      const record = requireRecord(manifest.credentialId);
+      if (record.material !== null && record.material.class !== "task-secret") throw new CredentialLeaseError("task secret material is incomplete");
+      return Object.freeze({ manifest: Object.freeze({ ...manifest, domains: Object.freeze([...manifest.domains]) as unknown as string[] }), material: record.material as Readonly<TaskSecretMaterial> | null });
+    })) } : {}),
     engines: Object.freeze(engines),
     mcp: Object.freeze(mcp),
     github: staticCredential<GithubLeasedValue>(lease.manifest.github, "github"),
@@ -1671,7 +1682,7 @@ export class TaskCredentialLeaseRegistry {
           !descriptor.parameter ||
           !descriptor.version ||
           !descriptor.sessionId ||
-          !descriptor.location
+          (!descriptor.location && !descriptor.taskSecret)
         ) {
           throw new CredentialLeaseError("manifest credential is incomplete");
         }
@@ -1729,7 +1740,13 @@ export class TaskCredentialLeaseRegistry {
       if (!selectors.includes(selector)) {
         throw new CredentialLeaseError("Parameter Store returned an unrequested credential version");
       }
-      const material = parseLeasedValue(parameter.value, descriptor.location!);
+      let material: LeasedValue | TaskSecretMaterial | null;
+      if (descriptor.taskSecret) {
+        const { entry, orgId, taskId } = descriptor.taskSecret;
+        const digest = createHash("sha256").update(entry.name).digest("hex");
+        if (entry.parameter !== `/uai/lease/tasks/${taskId}/secrets/${digest}/${entry.stagingId}`) throw new CredentialLeaseError("task secret parameter does not match its name");
+        material = parseTaskSecretMaterial(parameter.value, { orgId, taskId, name: entry.name, stagingId: entry.stagingId });
+      } else material = parseLeasedValue(parameter.value, descriptor.location!);
       if (!material || !materialMatchesDescriptor(material, descriptor)) {
         throw new CredentialLeaseError("credential envelope does not match its manifest entry");
       }

package/lib/cloud-credential-runtime.ts

@@ -1,3 +1,5 @@
+import type { TaskSecretApplied } from "../src/task-secrets";
+import { openTaskSecrets, closeTaskSecrets } from "./credential-consumers/task-secrets";
 /**
  * ADR-154 on the runner: the one place a task on cloud credentials is wired.
  *
@@ -148,7 +150,7 @@ export class AuthoritativeTaskFilesFailure extends Error {
 export interface CloudCredentialRuntimeDeps {
   runnerKind: "owned" | "task-machine";
   /** To the cloud, over the authenticated bridge. False: not sent now. */
-  send(frame: LeaseRequestV1Frame | CredentialRefreshFrame | ProjectEnvReplicaV1AckFrame): boolean;
+  send(frame: LeaseRequestV1Frame | CredentialRefreshFrame | ProjectEnvReplicaV1AckFrame | TaskSecretApplied): boolean;
   /** Every engine of the run (and older) proven stopped in every runtime it
    *  ran in: the orchestrator's `quiesceLeasedEngineAgents`. */
   quiesceProcesses(request: TaskCredentialCleanupRequest): Promise<void>;
@@ -1069,6 +1071,7 @@ export class CloudCredentialRuntime {
 
   #openGate(assignment: Readonly<TaskAssignment>, view: TaskCredentialView): void {
     if (this.#shutDown) throw new CredentialLeaseUnavailableError("the runner is shutting down");
+    openTaskSecrets(assignment, view);
     openEngineGate(assignment, view);
     openMcpGate(assignment, view);
     openPersonCredentialGate(assignment, view);
@@ -1085,6 +1088,11 @@ export class CloudCredentialRuntime {
     this.#personCredentialsChanged(assignment, view);
     this.#publishMcpMembership(assignment.taskId, view);
     this.#runRecoveredSetup(assignment);
+    // Empty sets matter too: a new runner process may first see a parked task after revocation.
+    queueMicrotask(() => {
+      if (this.#shutDown || this.registry.currentView(assignment) !== view) return;
+      this.#deps.send({ kind: "task.secret.applied", taskId: assignment.taskId, runEpoch: assignment.runEpoch, manifestRevision: view.manifestRevision, manifestDigest: view.manifestDigest });
+    });
   }
 
   #personCredentialsChanged(assignment: Readonly<TaskAssignment>, view: TaskCredentialView): void {
@@ -1201,6 +1209,7 @@ export class CloudCredentialRuntime {
         attempt(() => entry.controller.abort(new CredentialLeaseUnavailableError("the task's credentials were withdrawn")));
       }
     }
+    attempt(() => closeTaskSecrets(assignment));
     attempt(() => closeEngineGate(assignment));
     attempt(() => {
       const mcp = leasedMcpFor(assignment.taskId);

package/lib/credential-consumers/task-secrets.ts

@@ -0,0 +1,10 @@
+import type { TaskAssignment, TaskCredentialView } from "../cloud-credential-leases";
+const served = new Map<string, TaskCredentialView>();
+export function openTaskSecrets(assignment: Readonly<TaskAssignment>, view: TaskCredentialView): void { if (view.assignment.taskId !== assignment.taskId || view.assignment.runEpoch !== assignment.runEpoch) throw new Error("task secret assignment mismatch"); served.set(assignment.taskId, view); }
+export function closeTaskSecrets(assignment: Readonly<TaskAssignment>): void { const view = served.get(assignment.taskId); if (view && view.assignment.runEpoch <= assignment.runEpoch) served.delete(assignment.taskId); }
+export function taskSecretsView(taskId: string, runEpoch?: number | null) { const view = served.get(taskId); return view && (runEpoch == null || view.assignment.runEpoch === runEpoch) ? view.taskSecrets ?? [] : []; }
+export function deliveredTaskSecrets(taskId: string, runEpoch?: number | null): { revision: string; withheld: string[]; values: Record<string, string> } {
+ const entries = taskSecretsView(taskId, runEpoch); const values: Record<string,string> = Object.create(null) as Record<string,string>;
+ for (const e of entries) if (e.manifest.mode === "delivered" && e.material) values[e.manifest.name] = e.material.value;
+ return { revision: JSON.stringify(entries.map(e => [e.manifest.name, e.manifest.generation, e.material !== null])), withheld: entries.map(e => e.manifest.name), values };
+}

package/lib/engine-accounts.ts

@@ -1,3 +1,4 @@
+import { ENGINE_ACCOUNT_PATHS } from "../src/engine-account-paths";
 /**
  * Engine accounts (ADR-076) — multiple credentials per engine kind, selected
  * by ENV at each `docker exec`, rotated automatically with rate-limit failover.
@@ -97,26 +98,23 @@ const KINDS: Record<string, KindDescriptor> = {
   grok: {
     authKind: "config-dir",
     defaultHostDir: (owner) => join(owner, ".grok"),
-    defaultContainerDir: "/home/node/.grok",
+    ...ENGINE_ACCOUNT_PATHS.grok,
     selectVar: "GROK_HOME",
-    containerDirPrefix: "/home/node/.grok-acct-",
     extraHostDir: (owner, id) => join(owner, `.grok-acct-${id}`),
   },
   cursor: { authKind: "env" },
   codex: {
     authKind: "config-dir",
     defaultHostDir: (owner) => join(owner, ".codex"),
-    defaultContainerDir: "/home/node/.codex",
+    ...ENGINE_ACCOUNT_PATHS.codex,
     selectVar: "CODEX_HOME",
-    containerDirPrefix: "/home/node/.codex-acct-",
     extraHostDir: (owner, id) => join(owner, `.codex-acct-${id}`),
   },
   opencode: {
     authKind: "config-dir",
     defaultHostDir: (owner) => join(owner, ".local", "share", "opencode"),
-    defaultContainerDir: "/home/node/.local/share/opencode",
+    ...ENGINE_ACCOUNT_PATHS.opencode,
     selectVar: "OPENCODE_DATA_DIR",
-    containerDirPrefix: "/home/node/.local/share/opencode-acct-",
     extraHostDir: (owner, id) => join(owner, ".local", "share", `opencode-acct-${id}`),
   },
 };

package/lib/host-env.ts

@@ -23,7 +23,7 @@ import {
   queueStoreWrite,
   type CredentialStore,
 } from "./credential-store";
-import { ENGINE_ENV_CREDENTIAL_KEYS } from "../src/cloud-credentials";
+import { isReservedTaskEnvName } from "../src/task-env-names";
 import { getDb, schema } from "./db";
 import { sealAesGcm, openAesGcm } from "./secrets";
 import { signInBoxMode } from "./signin-box";
@@ -401,32 +401,7 @@ export function getDecryptedForProject(projectId: string): Record<string, string
  * container tasks: git/gh plumbing, loader and shell hooks, toolchain config,
  * the host's own `UAI_*` namespace, engine credentials, and the browser path.
  */
-const RESERVED_TASK_ENV_EXACT = new Set([
-  "GH_TOKEN", "GITHUB_TOKEN", "GH_CONFIG_DIR", "GH_HOST",
-  "GIT_DIR", "GIT_WORK_TREE", "GIT_COMMON_DIR", "GIT_OBJECT_DIRECTORY",
-  "GIT_ALTERNATE_OBJECT_DIRECTORIES", "GIT_INDEX_FILE", "GIT_EXEC_PATH",
-  "GIT_ASKPASS", "SSH_ASKPASS", "GIT_SSH", "GIT_SSH_COMMAND",
-  "HOME", "XDG_CONFIG_HOME", "XDG_DATA_HOME", "XDG_CACHE_HOME",
-  "PATH", "LD_PRELOAD", "LD_AUDIT", "LD_LIBRARY_PATH", "NODE_OPTIONS",
-  "NODE_PATH", "SHELL", "SHELLOPTS", "BASHOPTS", "PS4", "BASH_ENV", "ENV",
-  "NODE_EXTRA_CA_CERTS", "SSL_CERT_FILE", "REQUESTS_CA_BUNDLE",
-  "__CURSOR_SANDBOX_ENV_RESTORE", "GROK_LOGIN_ENV",
-  // Every name an env-token engine's account may set (ADR-154's contract):
-  // a project value never stands in for an engine's credential.
-  ...Object.values(ENGINE_ENV_CREDENTIAL_KEYS).flat(),
-  "PLAYWRIGHT_BROWSERS_PATH",
-]);
-const RESERVED_TASK_ENV_NPM = /^npm_config_(prefix|cache|logs[_-]dir|umask)$/i;
-/** Toolchain prefixes, in any case, as task-up.sh matches them. */
-const RESERVED_TASK_ENV_TOOLCHAIN = /^(asdf|corepack)_/i;
-
-export function isReservedTaskEnvName(name: string): boolean {
-  if (RESERVED_TASK_ENV_EXACT.has(name)) return true;
-  if (name.startsWith("GIT_CONFIG") || RESERVED_TASK_ENV_TOOLCHAIN.test(name)) return true;
-  if (name.startsWith("UAI_")) return true;
-  if (name.startsWith("__UAI_ENV_")) return true;
-  return RESERVED_TASK_ENV_NPM.test(name);
-}
+export { isReservedTaskEnvName } from "../src/task-env-names";
 
 /**
  * Rollout-only project env for an ADR-121 machine task whose persisted mode