@runuai/host 0.9.167 → 0.9.169

package/lib/agents/cursor.ts

@@ -269,21 +269,25 @@ export class CursorSession implements AgentSession {
   }
 
   /**
-   * One dashboard probe for a leased account, overlapped with the turn. A
-   * missing lease, a probe still inside the five-minute gate, or any failure
-   * sends nothing. The token never leaves this method except as the bearer
-   * of the two dashboard calls.
+   * One dashboard probe for a leased account. The read runs after the CLI
+   * child has exited: the CLI rewrites ~/.config/cursor/auth.json at
+   * startup, and a probe overlapped with the turn reads the expired access
+   * token. A missing lease, a probe still inside the five-minute gate, or
+   * any failure sends nothing. The token never leaves this method except
+   * as the bearer of the two dashboard calls.
    *
    * The credential is marked before the first await. Two sessions that start
-   * together must not both pass the gate.
+   * together must not both pass the gate. The returned function is the read;
+   * call it once the child has exited, still before turn_complete.
    */
-  private probePeriodUsage(): Promise<void> {
+  private probePeriodUsage(): () => Promise<void> {
+    const skip = (): Promise<void> => Promise.resolve();
     const credentialId = this.agentEnv[ENGINE_ACCOUNT_ENV];
-    if (!credentialId || this.closed) return Promise.resolve();
+    if (!credentialId || this.closed) return skip;
     const now = Date.now();
-    if (!cursorPeriodProbeDue(credentialId, now)) return Promise.resolve();
+    if (!cursorPeriodProbeDue(credentialId, now)) return skip;
     markCursorPeriodProbed(credentialId, now);
-    return this.readPeriodUsage();
+    return () => this.readPeriodUsage();
   }
 
   /** Auth read and both dashboard calls share one deadline. On expiry the
@@ -388,6 +392,8 @@ export class CursorSession implements AgentSession {
 
     const child = this.spawner(this.buildRequest(prompt));
     this.current = child;
+    // Mark the gate now, before the child-exit await. The read itself waits
+    // until the CLI has rewritten auth.json.
     const periodUsage = this.probePeriodUsage();
 
     let acc = "";
@@ -520,7 +526,7 @@ export class CursorSession implements AgentSession {
       child.on("exit", (code) => finish(code));
       child.on("error", (err) => finish(null, err.message));
     });
-    await periodUsage;
+    await periodUsage();
     if (!this.closed) this.emit({ type: "turn_complete", usage: turnUsage });
   }
 

package/lib/agents/durable-proc.ts

@@ -1,3 +1,5 @@
+import { StringDecoder } from "node:string_decoder";
+import { agentOutputSource } from "./output-source";
 /**
  * DurableProcess (ADR-061) — LineProcess's durable twin. Instead of holding
  * the agent CLI's pipes, it talks to the in-container runner
@@ -84,6 +86,8 @@ export class DurableProcess {
   private readonly inbox: readonly string[];
   private readonly heartbeat: readonly string[];
 
+  private readonly decoder = new StringDecoder("utf8");
+  private lineOffset = 0;
   private readonly lineHandlers = new Set<LineHandler>();
   private readonly exitHandlers = new Set<ExitHandler>();
 
@@ -108,6 +112,7 @@ export class DurableProcess {
     this.inbox = [...opts.sessionFiles.parts, "inbox.jsonl"];
     this.heartbeat = [...opts.sessionFiles.parts, "heartbeat"];
     this.offset = opts.initialOutboxOffset ?? 0;
+    this.lineOffset = this.offset;
     this.onOffsetAdvance = opts.onOffsetAdvance ?? null;
     this.onCloseRequested = opts.onCloseRequested ?? null;
     if (opts.ready) {
@@ -156,7 +161,7 @@ export class DurableProcess {
         if (read === null) break; // outbox not created yet
         if (read.bytes.length === 0) break;
         this.offset += read.bytes.length;
-        this.lineBuf += read.bytes.toString("utf8");
+        this.lineBuf += this.decoder.write(read.bytes);
         this.drainLines();
         if (this.offset >= read.size) break;
       }
@@ -171,7 +176,7 @@ export class DurableProcess {
     }
     if (this.offset !== before && this.onOffsetAdvance && !this.closed) {
       try {
-        this.onOffsetAdvance(this.offset);
+        this.onOffsetAdvance(this.lineOffset);
       } catch {
         // Persistence hiccup — the next batch retries with a larger offset.
       }
@@ -182,7 +187,9 @@ export class DurableProcess {
   private drainLines(): void {
     let nl: number;
     while ((nl = this.lineBuf.indexOf("\n")) >= 0) {
-      const line = this.lineBuf.slice(0, nl).trim();
+      const rawLine = this.lineBuf.slice(0, nl);
+      this.lineOffset += Buffer.byteLength(rawLine) + 1;
+      const line = rawLine.trim();
       this.lineBuf = this.lineBuf.slice(nl + 1);
       if (line.length === 0) continue;
       if (line.startsWith('{"__uai"')) {
@@ -192,7 +199,7 @@ export class DurableProcess {
       if (this.debug) this.log(`<- ${line.slice(0, 1000)}`);
       for (const h of this.lineHandlers) {
         try {
-          h(line);
+          agentOutputSource.run(this.durableSessionDir + ":" + this.lineOffset, () => h(line));
         } catch {
           // A broken handler must not wedge the tail loop.
         }
@@ -293,7 +300,7 @@ export class DurableProcess {
 
   /** Consumed-outbox byte offset — persist this to survive host restarts. */
   get outboxOffset(): number {
-    return this.offset;
+    return this.lineOffset;
   }
 
   /**

package/lib/agents/machine-durable.ts

@@ -1,3 +1,5 @@
+import { StringDecoder } from "node:string_decoder";
+import { agentOutputSource } from "./output-source";
 /**
  * ADR-121 + ADR-061: durable agent sessions for MACHINE-backed tasks.
  *
@@ -139,6 +141,8 @@ export class MachineDurableProcess implements LineTransport {
   readonly #lineHandlers = new Set<LineHandler>();
   readonly #exitHandlers = new Set<ExitHandler>();
 
+  readonly #decoder = new StringDecoder("utf8");
+  #lineOffset = 0;
   #offset: number;
   #lineBuf = "";
   #stderrBuf = "";
@@ -166,6 +170,7 @@ export class MachineDurableProcess implements LineTransport {
     this.#outboxPath = posix.join(opts.sessionDir, "outbox.jsonl");
     this.#inboxPath = posix.join(opts.sessionDir, "inbox.jsonl");
     this.#offset = opts.initialOutboxOffset ?? 0;
+    this.#lineOffset = this.#offset;
     this.#onOffsetAdvance = opts.onOffsetAdvance ?? null;
     this.#onCloseRequested = opts.onCloseRequested ?? null;
     this.#debug =
@@ -248,11 +253,11 @@ export class MachineDurableProcess implements LineTransport {
           if (generation !== this.#tailGeneration) break;
           const text = Buffer.from(chunk);
           this.#offset += text.byteLength;
-          this.#lineBuf += text.toString("utf8");
+          this.#lineBuf += this.#decoder.write(text);
           this.#drainLines();
           if (this.#onOffsetAdvance && !this.#closed) {
             try {
-              this.#onOffsetAdvance(this.#offset);
+              this.#onOffsetAdvance(this.#lineOffset);
             } catch {
               // Persistence hiccup — the next batch retries larger.
             }
@@ -282,7 +287,9 @@ export class MachineDurableProcess implements LineTransport {
   #drainLines(): void {
     let nl: number;
     while ((nl = this.#lineBuf.indexOf("\n")) >= 0) {
-      const line = this.#lineBuf.slice(0, nl).trim();
+      const rawLine = this.#lineBuf.slice(0, nl);
+      this.#lineOffset += Buffer.byteLength(rawLine) + 1;
+      const line = rawLine.trim();
       this.#lineBuf = this.#lineBuf.slice(nl + 1);
       if (line.length === 0) continue;
       if (line.startsWith('{"__uai"')) {
@@ -292,7 +299,7 @@ export class MachineDurableProcess implements LineTransport {
       if (this.#debug) this.#log(`<- ${line.slice(0, 1000)}`);
       for (const handler of this.#lineHandlers) {
         try {
-          handler(line);
+          agentOutputSource.run(this.durableSessionDir + ":" + this.#lineOffset, () => handler(line));
         } catch {
           // A broken handler must not wedge the tail loop.
         }
@@ -464,7 +471,7 @@ export class MachineDurableProcess implements LineTransport {
   }
 
   get outboxOffset(): number {
-    return this.#offset;
+    return this.#lineOffset;
   }
 
   /** Stop consuming WITHOUT touching the runner (host restart in miniature). */

package/lib/agents/output-source.ts

@@ -0,0 +1,3 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+/** Stable outbox position follows adapter async work, never a timestamp. */
+export const agentOutputSource = new AsyncLocalStorage<string>();

package/lib/agents/transport.ts

@@ -118,6 +118,11 @@ interface DetachableTail extends LineTransport {
 
 const liveTails = new Map<string, DetachableTail>();
 
+export function durableAgentSessionId(taskId: string, agentId: string): string | undefined {
+  const tail = liveTails.get(`${taskId}:${agentId}`);
+  return tail && !tail.isClosed ? tail.durableSessionDir : undefined;
+}
+
 function claimTail<T extends DetachableTail>(key: string, proc: T): T {
   liveTails.get(key)?.detach();
   liveTails.set(key, proc);

package/lib/assignment-evidence.ts

@@ -0,0 +1,93 @@
+/** Host-owned durable correlation, independent of a CLI's mutable history. */
+import { randomUUID } from "node:crypto";
+import { closeSync, fsyncSync, mkdirSync, openSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
+import type { AssignmentDelivery, AssignmentTurnEvidence } from "../src/protocol";
+
+interface State {
+  sessionId: string;
+  current: AssignmentDelivery | null;
+  active: AssignmentTurnEvidence[];
+  deliveries: string[];
+  observations: Record<string, AssignmentTurnEvidence>;
+}
+/** One journal per task/agent, in runner-private task data, never /workspace. */
+export class AssignmentEvidenceJournal {
+  constructor(private readonly path: string) {}
+  private read(sessionId: string): State {
+    let state: State;
+    try { state = JSON.parse(readFileSync(this.path, "utf8")) as State; }
+    catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
+      return { sessionId, current: null, active: [], deliveries: [], observations: {} };
+    }
+    // A replacement CLI is a new execution generation; never attach the
+    // predecessor's turn to it. Explicit redispatch can restore the assignment.
+    return state.sessionId === sessionId ? state : { sessionId, current: state.current, active: [], deliveries: [], observations: {} };
+  }
+  private write(state: State) {
+    mkdirSync(dirname(this.path), { recursive: true, mode: 0o700 });
+    const temp = this.path + "." + randomUUID();
+    const fd = openSync(temp, "wx", 0o600);
+    try { writeFileSync(fd, JSON.stringify(state)); fsyncSync(fd); } finally { closeSync(fd); }
+    renameSync(temp, this.path);
+    const dir = openSync(dirname(this.path), "r");
+    try { fsyncSync(dir); } finally { closeSync(dir); }
+  }
+  begin(input: { sessionId: string; engine: string; runEpoch: number; runtimeVersion: string | null; recipientGeneration: string | null; assignment?: AssignmentDelivery | null; replay?: boolean; leadRunId?: string | null }): (AssignmentTurnEvidence & { assignment: AssignmentDelivery | null }) | null {
+    const state = this.read(input.sessionId);
+    if (state.current && (state.current.runEpoch !== input.runEpoch || state.current.recipientGeneration !== input.recipientGeneration)) {
+      state.current = null;
+      state.active = [];
+      state.deliveries = [];
+    }
+    // Assignment id, not attempt id: a lost cloud ack must not send the same
+    // instruction twice. Old attempts retain their original provenance.
+    if (!input.replay && input.assignment && state.deliveries.includes(input.assignment.assignmentId)) return null;
+    if (input.assignment) {
+      // A replay carries its original identity without retargeting subsequent
+      // new inputs to an older assignment. Deduplication applies to cloud
+      // deliveries; an internally retained prompt is an execution retry.
+      if (!input.replay) state.current = input.assignment;
+      if (!state.deliveries.includes(input.assignment.assignmentId)) state.deliveries.push(input.assignment.assignmentId);
+    }
+    const current = input.assignment === null ? null : input.assignment ?? state.current;
+    const evidence: AssignmentTurnEvidence = {
+      turnId: randomUUID(), sessionId: input.sessionId, runEpoch: input.runEpoch,
+      assignmentId: current?.assignmentId ?? null, deliveryId: current?.deliveryId ?? null,
+      recipientGeneration: current?.recipientGeneration ?? (input.leadRunId ? input.recipientGeneration : null),
+      ...(input.leadRunId ? { leadRunId: input.leadRunId } : {}),
+      correlation: input.assignment || input.leadRunId ? "explicit" : current ? "followup" : "unknown",
+      acceptedAt: Date.now(), engine: input.engine, runtimeVersion: input.runtimeVersion,
+    };
+    // Concurrent prompts aren't assumed to execute FIFO. Without a provider
+    // turn/request join, every overlapping turn is explicitly unallocated.
+    if (state.active.length) {
+      for (const turn of state.active) { turn.assignmentId = null; turn.deliveryId = null; turn.leadRunId = null; turn.correlation = "ambiguous"; }
+      evidence.assignmentId = null; evidence.deliveryId = null; evidence.leadRunId = null; evidence.correlation = "ambiguous";
+    }
+    state.active.push(evidence);
+    this.write(state);
+    return { ...evidence, assignment: current };
+  }
+  observe(sessionId: string, sourceId: string | undefined, complete: boolean): AssignmentTurnEvidence | undefined {
+    const state = this.read(sessionId);
+    if (sourceId && state.observations[sourceId]) return state.observations[sourceId];
+    const active = state.active[0];
+    if (!active) return undefined;
+    const evidence = { ...active, ...(complete ? { endedAt: Date.now() } : {}) };
+    if (sourceId) state.observations[sourceId] = evidence;
+    if (complete) state.active.shift();
+    this.write(state);
+    return evidence;
+  }
+  failed(sessionId: string, turnId: string): void {
+    const state = this.read(sessionId);
+    const turn = state.active.find(t => t.turnId === turnId);
+    state.active = state.active.filter(t => t.turnId !== turnId);
+    // Failure before acceptance allows retry. Ambiguous sends stay unknown;
+    // never manufacture a successful execution from delivery alone.
+    if (turn?.assignmentId) state.deliveries = state.deliveries.filter(id => id !== turn.assignmentId);
+    this.write(state);
+  }
+}

package/lib/cloud-credential-leases.ts

@@ -1,3 +1,4 @@
+import { parseTaskSecretMaterial, type TaskSecretManifestEntry, type TaskSecretMaterial } from "../src/task-secrets";
 /**
  * ADR-154 task-scoped credential leases.
  *
@@ -86,7 +87,7 @@ export type LeaseGateCloseReason =
 export type CredentialCleanupReason = LeaseGateCloseReason | "lease-replaced";
 
 export interface CredentialCleanupIdentity {
-  class: "engine" | "mcp" | "github" | "ssh";
+  class: "engine" | "mcp" | "github" | "ssh" | "task-secret";
   credentialId: string;
   revision: string | null;
 }
@@ -136,6 +137,7 @@ export interface TaskStaticCredential<T extends LeasedValue> {
 
 /** A task-facing view. It contains material, but never STS credentials. */
 export interface TaskCredentialView {
+  taskSecrets?: readonly { manifest: Readonly<TaskSecretManifestEntry>; material: Readonly<TaskSecretMaterial> | null }[];
   assignment: Readonly<TaskAssignment>;
   leaseId: string;
   manifestRevision: number;
@@ -293,12 +295,13 @@ type CredentialDescriptor = {
   sessionId: string | null;
   authKind: "env" | "config-dir" | "oauth" | "token" | "none" | null;
   location: CredentialLocation | null;
+  taskSecret?: { entry: TaskSecretManifestEntry; orgId: string; taskId: string };
 };
 
 type CredentialRecord = {
   descriptor: CredentialDescriptor;
   availability: CredentialMaterialAvailability;
-  material: LeasedValue | null;
+  material: LeasedValue | TaskSecretMaterial | null;
   observedVersion: number | null;
 };
 
@@ -527,13 +530,16 @@ function manifestDescriptors(lease: TaskLeaseV1): CredentialDescriptor[] {
     ...lease.manifest.engines.map(descriptorFromEngine),
     ...lease.manifest.mcp.map(descriptorFromMcp),
   ];
+  for (const entry of lease.manifest.taskSecrets ?? []) out.push({ class: "task-secret", credentialId: entry.credentialId,
+    revision: String(entry.generation), parameter: entry.parameter, version: entry.version, sessionId: entry.sessionId,
+    authKind: null, location: null, taskSecret: { entry, orgId: lease.orgId, taskId: lease.taskId } });
   if (lease.manifest.github) out.push(descriptorFromStatic(lease.manifest.github, "github"));
   if (lease.manifest.ssh) out.push(descriptorFromStatic(lease.manifest.ssh, "ssh"));
   return out;
 }
 
 function materialMatchesDescriptor(
-  material: LeasedValue,
+  material: LeasedValue | TaskSecretMaterial,
   descriptor: CredentialDescriptor,
 ): boolean {
   if (material.class !== descriptor.class) return false;
@@ -542,7 +548,7 @@ function materialMatchesDescriptor(
   return descriptor.authKind === null;
 }
 
-function freezeMaterial<T extends LeasedValue>(material: T): Readonly<T> {
+function freezeMaterial<T extends LeasedValue | TaskSecretMaterial>(material: T): Readonly<T> {
   Object.freeze(material.location);
   if (material.class === "engine") {
     if (material.authKind === "env") Object.freeze(material.env);
@@ -628,6 +634,11 @@ function freezeView(
     manifestDigest: lease.manifestDigest,
     expiresAt,
     projectIds: Object.freeze(lease.manifest.projects.map((project) => project.projectId)),
+    ...(lease.manifest.taskSecrets?.length ? { taskSecrets: Object.freeze(lease.manifest.taskSecrets.map(manifest => {
+      const record = requireRecord(manifest.credentialId);
+      if (record.material !== null && record.material.class !== "task-secret") throw new CredentialLeaseError("task secret material is incomplete");
+      return Object.freeze({ manifest: Object.freeze({ ...manifest, domains: Object.freeze([...manifest.domains]) as unknown as string[] }), material: record.material as Readonly<TaskSecretMaterial> | null });
+    })) } : {}),
     engines: Object.freeze(engines),
     mcp: Object.freeze(mcp),
     github: staticCredential<GithubLeasedValue>(lease.manifest.github, "github"),
@@ -1671,7 +1682,7 @@ export class TaskCredentialLeaseRegistry {
           !descriptor.parameter ||
           !descriptor.version ||
           !descriptor.sessionId ||
-          !descriptor.location
+          (!descriptor.location && !descriptor.taskSecret)
         ) {
           throw new CredentialLeaseError("manifest credential is incomplete");
         }
@@ -1729,7 +1740,13 @@ export class TaskCredentialLeaseRegistry {
       if (!selectors.includes(selector)) {
         throw new CredentialLeaseError("Parameter Store returned an unrequested credential version");
       }
-      const material = parseLeasedValue(parameter.value, descriptor.location!);
+      let material: LeasedValue | TaskSecretMaterial | null;
+      if (descriptor.taskSecret) {
+        const { entry, orgId, taskId } = descriptor.taskSecret;
+        const digest = createHash("sha256").update(entry.name).digest("hex");
+        if (entry.parameter !== `/uai/lease/tasks/${taskId}/secrets/${digest}/${entry.stagingId}`) throw new CredentialLeaseError("task secret parameter does not match its name");
+        material = parseTaskSecretMaterial(parameter.value, { orgId, taskId, name: entry.name, stagingId: entry.stagingId });
+      } else material = parseLeasedValue(parameter.value, descriptor.location!);
       if (!material || !materialMatchesDescriptor(material, descriptor)) {
         throw new CredentialLeaseError("credential envelope does not match its manifest entry");
       }

package/lib/cloud-credential-runtime.ts

@@ -1,3 +1,5 @@
+import type { TaskSecretApplied } from "../src/task-secrets";
+import { openTaskSecrets, closeTaskSecrets } from "./credential-consumers/task-secrets";
 /**
  * ADR-154 on the runner: the one place a task on cloud credentials is wired.
  *
@@ -148,7 +150,7 @@ export class AuthoritativeTaskFilesFailure extends Error {
 export interface CloudCredentialRuntimeDeps {
   runnerKind: "owned" | "task-machine";
   /** To the cloud, over the authenticated bridge. False: not sent now. */
-  send(frame: LeaseRequestV1Frame | CredentialRefreshFrame | ProjectEnvReplicaV1AckFrame): boolean;
+  send(frame: LeaseRequestV1Frame | CredentialRefreshFrame | ProjectEnvReplicaV1AckFrame | TaskSecretApplied): boolean;
   /** Every engine of the run (and older) proven stopped in every runtime it
    *  ran in: the orchestrator's `quiesceLeasedEngineAgents`. */
   quiesceProcesses(request: TaskCredentialCleanupRequest): Promise<void>;
@@ -1069,6 +1071,7 @@ export class CloudCredentialRuntime {
 
   #openGate(assignment: Readonly<TaskAssignment>, view: TaskCredentialView): void {
     if (this.#shutDown) throw new CredentialLeaseUnavailableError("the runner is shutting down");
+    openTaskSecrets(assignment, view);
     openEngineGate(assignment, view);
     openMcpGate(assignment, view);
     openPersonCredentialGate(assignment, view);
@@ -1085,6 +1088,11 @@ export class CloudCredentialRuntime {
     this.#personCredentialsChanged(assignment, view);
     this.#publishMcpMembership(assignment.taskId, view);
     this.#runRecoveredSetup(assignment);
+    // Empty sets matter too: a new runner process may first see a parked task after revocation.
+    queueMicrotask(() => {
+      if (this.#shutDown || this.registry.currentView(assignment) !== view) return;
+      this.#deps.send({ kind: "task.secret.applied", taskId: assignment.taskId, runEpoch: assignment.runEpoch, manifestRevision: view.manifestRevision, manifestDigest: view.manifestDigest });
+    });
   }
 
   #personCredentialsChanged(assignment: Readonly<TaskAssignment>, view: TaskCredentialView): void {
@@ -1201,6 +1209,7 @@ export class CloudCredentialRuntime {
         attempt(() => entry.controller.abort(new CredentialLeaseUnavailableError("the task's credentials were withdrawn")));
       }
     }
+    attempt(() => closeTaskSecrets(assignment));
     attempt(() => closeEngineGate(assignment));
     attempt(() => {
       const mcp = leasedMcpFor(assignment.taskId);

package/lib/credential-consumers/task-secrets.ts

@@ -0,0 +1,10 @@
+import type { TaskAssignment, TaskCredentialView } from "../cloud-credential-leases";
+const served = new Map<string, TaskCredentialView>();
+export function openTaskSecrets(assignment: Readonly<TaskAssignment>, view: TaskCredentialView): void { if (view.assignment.taskId !== assignment.taskId || view.assignment.runEpoch !== assignment.runEpoch) throw new Error("task secret assignment mismatch"); served.set(assignment.taskId, view); }
+export function closeTaskSecrets(assignment: Readonly<TaskAssignment>): void { const view = served.get(assignment.taskId); if (view && view.assignment.runEpoch <= assignment.runEpoch) served.delete(assignment.taskId); }
+export function taskSecretsView(taskId: string, runEpoch?: number | null) { const view = served.get(taskId); return view && (runEpoch == null || view.assignment.runEpoch === runEpoch) ? view.taskSecrets ?? [] : []; }
+export function deliveredTaskSecrets(taskId: string, runEpoch?: number | null): { revision: string; withheld: string[]; values: Record<string, string> } {
+ const entries = taskSecretsView(taskId, runEpoch); const values: Record<string,string> = Object.create(null) as Record<string,string>;
+ for (const e of entries) if (e.manifest.mode === "delivered" && e.material) values[e.manifest.name] = e.material.value;
+ return { revision: JSON.stringify(entries.map(e => [e.manifest.name, e.manifest.generation, e.material !== null])), withheld: entries.map(e => e.manifest.name), values };
+}

package/lib/disk-pressure.ts

@@ -0,0 +1,42 @@
+import { execFile } from "node:child_process";
+import { statfs } from "node:fs/promises";
+import { homedir } from "node:os";
+import type { HostCapabilities } from "../src/protocol";
+
+type DiskSample = NonNullable<HostCapabilities["disk"]>;
+const dockerInfo = (args: string[]): Promise<string | null> => new Promise(resolve => {
+  execFile("docker", args, { timeout: 5_000, maxBuffer: 4096 }, (error, stdout) => {
+    resolve(error ? null : stdout.trim());
+  });
+});
+async function dockerRoot(): Promise<string | null> {
+  // A remote daemon (including Docker Desktop's VM) has no local filesystem
+  // we can measure. Never report a coincidentally matching local path.
+  if (process.platform !== "linux") return null;
+  const endpoint = process.env.DOCKER_HOST && !process.env.DOCKER_CONTEXT
+    ? process.env.DOCKER_HOST
+    : await dockerInfo(["context", "inspect", "--format", "{{.Endpoints.docker.Host}}"]);
+  if (!endpoint?.startsWith("unix://")) return null;
+  // Do not guess /var/lib/docker: data-root can be configured elsewhere.
+  const root = await dockerInfo(["info", "--format", "{{.DockerRootDir}}"]);
+  return root?.startsWith("/") ? root : null;
+}
+
+async function measure(path: string | null): Promise<DiskSample["home"]> {
+  if (!path) return null;
+  try {
+    const fs = await statfs(path);
+    const totalBytes = fs.blocks * fs.bsize;
+    // bavail (not bfree) accounts for root-reserved blocks: the host's
+    // unprivileged updater cannot use those even though root can.
+    const availableBytes = Math.max(0, fs.bavail * fs.bsize);
+    if (!Number.isSafeInteger(totalBytes) || totalBytes <= 0 || !Number.isSafeInteger(availableBytes) || availableBytes < 0 || availableBytes > totalBytes) return null;
+    return { totalBytes, availableBytes };
+  } catch { return null; }
+}
+
+export async function sampleDiskPressure(): Promise<DiskSample> {
+  const [home, docker] = await Promise.all([measure(homedir()), dockerRoot().then(measure)]);
+  // No local paths are sent to the cloud; an unavailable probe is unknown.
+  return { sampledAt: Date.now(), home, docker };
+}

package/lib/engine-accounts.ts

@@ -1,3 +1,4 @@
+import { ENGINE_ACCOUNT_PATHS } from "../src/engine-account-paths";
 /**
  * Engine accounts (ADR-076) — multiple credentials per engine kind, selected
  * by ENV at each `docker exec`, rotated automatically with rate-limit failover.
@@ -97,26 +98,23 @@ const KINDS: Record<string, KindDescriptor> = {
   grok: {
     authKind: "config-dir",
     defaultHostDir: (owner) => join(owner, ".grok"),
-    defaultContainerDir: "/home/node/.grok",
+    ...ENGINE_ACCOUNT_PATHS.grok,
     selectVar: "GROK_HOME",
-    containerDirPrefix: "/home/node/.grok-acct-",
     extraHostDir: (owner, id) => join(owner, `.grok-acct-${id}`),
   },
   cursor: { authKind: "env" },
   codex: {
     authKind: "config-dir",
     defaultHostDir: (owner) => join(owner, ".codex"),
-    defaultContainerDir: "/home/node/.codex",
+    ...ENGINE_ACCOUNT_PATHS.codex,
     selectVar: "CODEX_HOME",
-    containerDirPrefix: "/home/node/.codex-acct-",
     extraHostDir: (owner, id) => join(owner, `.codex-acct-${id}`),
   },
   opencode: {
     authKind: "config-dir",
     defaultHostDir: (owner) => join(owner, ".local", "share", "opencode"),
-    defaultContainerDir: "/home/node/.local/share/opencode",
+    ...ENGINE_ACCOUNT_PATHS.opencode,
     selectVar: "OPENCODE_DATA_DIR",
-    containerDirPrefix: "/home/node/.local/share/opencode-acct-",
     extraHostDir: (owner, id) => join(owner, ".local", "share", `opencode-acct-${id}`),
   },
 };

package/lib/host-env.ts

@@ -23,7 +23,7 @@ import {
   queueStoreWrite,
   type CredentialStore,
 } from "./credential-store";
-import { ENGINE_ENV_CREDENTIAL_KEYS } from "../src/cloud-credentials";
+import { isReservedTaskEnvName } from "../src/task-env-names";
 import { getDb, schema } from "./db";
 import { sealAesGcm, openAesGcm } from "./secrets";
 import { signInBoxMode } from "./signin-box";
@@ -401,32 +401,7 @@ export function getDecryptedForProject(projectId: string): Record<string, string
  * container tasks: git/gh plumbing, loader and shell hooks, toolchain config,
  * the host's own `UAI_*` namespace, engine credentials, and the browser path.
  */
-const RESERVED_TASK_ENV_EXACT = new Set([
-  "GH_TOKEN", "GITHUB_TOKEN", "GH_CONFIG_DIR", "GH_HOST",
-  "GIT_DIR", "GIT_WORK_TREE", "GIT_COMMON_DIR", "GIT_OBJECT_DIRECTORY",
-  "GIT_ALTERNATE_OBJECT_DIRECTORIES", "GIT_INDEX_FILE", "GIT_EXEC_PATH",
-  "GIT_ASKPASS", "SSH_ASKPASS", "GIT_SSH", "GIT_SSH_COMMAND",
-  "HOME", "XDG_CONFIG_HOME", "XDG_DATA_HOME", "XDG_CACHE_HOME",
-  "PATH", "LD_PRELOAD", "LD_AUDIT", "LD_LIBRARY_PATH", "NODE_OPTIONS",
-  "NODE_PATH", "SHELL", "SHELLOPTS", "BASHOPTS", "PS4", "BASH_ENV", "ENV",
-  "NODE_EXTRA_CA_CERTS", "SSL_CERT_FILE", "REQUESTS_CA_BUNDLE",
-  "__CURSOR_SANDBOX_ENV_RESTORE", "GROK_LOGIN_ENV",
-  // Every name an env-token engine's account may set (ADR-154's contract):
-  // a project value never stands in for an engine's credential.
-  ...Object.values(ENGINE_ENV_CREDENTIAL_KEYS).flat(),
-  "PLAYWRIGHT_BROWSERS_PATH",
-]);
-const RESERVED_TASK_ENV_NPM = /^npm_config_(prefix|cache|logs[_-]dir|umask)$/i;
-/** Toolchain prefixes, in any case, as task-up.sh matches them. */
-const RESERVED_TASK_ENV_TOOLCHAIN = /^(asdf|corepack)_/i;
-
-export function isReservedTaskEnvName(name: string): boolean {
-  if (RESERVED_TASK_ENV_EXACT.has(name)) return true;
-  if (name.startsWith("GIT_CONFIG") || RESERVED_TASK_ENV_TOOLCHAIN.test(name)) return true;
-  if (name.startsWith("UAI_")) return true;
-  if (name.startsWith("__UAI_ENV_")) return true;
-  return RESERVED_TASK_ENV_NPM.test(name);
-}
+export { isReservedTaskEnvName } from "../src/task-env-names";
 
 /**
  * Rollout-only project env for an ADR-121 machine task whose persisted mode