mercury-agent 0.18.2 → 0.20.0

package/src/agent/container-runner.ts

@@ -3,12 +3,23 @@ import { randomBytes } from "node:crypto";
 import fs from "node:fs";
 import path, { dirname } from "node:path";
 import { fileURLToPath } from "node:url";
-import { type AppConfig, resolveProjectPath } from "../config.js";
+import {
+  type AppConfig,
+  type ModelLeg,
+  resolveProjectPath,
+} from "../config.js";
 import { mintCallerToken } from "../core/caller-token.js";
 import { scanOutbox } from "../core/outbox.js";
 import type { ExtImageBuildState } from "../extensions/image-builder.js";
+import { readHostVersion } from "../host-version.js";
 import { type Logger, logger } from "../logger.js";
 import { ensurePiResourceDir } from "../storage/memory.js";
+import {
+  hostEnvVarForModelsJsonRef,
+  modelsJsonDefinesProvider,
+  modelsJsonEnvRefs,
+  parseModelsJson,
+} from "../storage/models-json.js";
 import {
   describeRefreshFailure,
   getPiAuthCredential,
@@ -32,6 +43,11 @@ import {
 import { RUN_TRACE_FILE } from "./container-entry.js";
 import { selectPassthroughEnv } from "./container-env.js";
 import { ContainerError } from "./container-error.js";
+import {
+  ensureAgentImage,
+  IMAGE_PULL_RECORD_FILE,
+  type ImagePullRecord,
+} from "./image-refresh.js";
 
 /**
  * In-container mountpoint for the per-message IO dir. The host passes the request
@@ -52,8 +68,9 @@ export const RUN_TRACE_DIR = "traces";
  * is deleted, so it outlives the `--rm` container that produced it.
  *
  * Returns the destination path, or null when there is nothing to harvest — the
- * container was killed before writing anything, or tracing was off for the run.
- * Never throws: losing a diagnostic must not change how a turn ends.
+ * container was killed before writing anything, or the run was neither traced
+ * (`TRACE_RUNS=1`) nor emitted a standalone `traceEvent`, so no file was ever
+ * created. Never throws: losing a diagnostic must not change how a turn ends.
  */
 export function harvestRunTrace(
   ioLocalDir: string,
@@ -447,7 +464,7 @@ function sleep(ms: number): Promise<void> {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
 
-type ExecResult = {
+export type ExecResult = {
   code: number;
   stdout: string;
   stderr: string;
@@ -518,7 +535,7 @@ function execCommand(
  * / `kill` / `pull` / `ps` / `rm` — all plain request/response Docker API
  * calls (no `/wait`, no attach), which the body-proxy forwards cleanly.
  */
-function execDocker(
+export function execDocker(
   args: string[],
   timeoutMs = EXEC_DOCKER_TIMEOUT_MS,
 ): Promise<ExecResult> {
@@ -808,6 +825,78 @@ export async function resolveOAuthCredentialForSpawn(
 const CONTAINER_LABEL = "mercury.managed=true";
 const AGENT_ID_LABEL_KEY = "mercury.agent-id";
 
+/**
+ * Every container Mercury creates carries these, so a process that dies
+ * mid-spawn leaves something the next boot's `cleanupOrphans` reaps. Exported
+ * because preflight's probe containers must be reapable by the same sweep.
+ */
+export const MERCURY_CONTAINER_LABEL = CONTAINER_LABEL;
+export const MERCURY_AGENT_ID_LABEL_KEY = AGENT_ID_LABEL_KEY;
+
+/**
+ * The gVisor arm of the production spawn, verbatim. Named so `reply()` and
+ * `mercury preflight`'s round trip build one shape from one list: a probe that
+ * passes a shape the real spawn does not run is the July 2026 post-mortem
+ * again (`--dev-bind / /` passed where `--proc /proc` failed).
+ *
+ * `CONTAINER_RUNTIME=runsc` rides along because it belongs to the same arm —
+ * container-entry reads it to skip the bwrap spawn path.
+ */
+export const RUNSC_HARDENING_ARGS: readonly string[] = [
+  "--runtime=runsc",
+  "--cap-drop=ALL",
+  "--security-opt=no-new-privileges",
+  "--memory=2g",
+  "--cpus=2",
+  "--pids-limit=512",
+  "-e",
+  "CONTAINER_RUNTIME=runsc",
+];
+
+/**
+ * The default-bridge arm: no `--network` flag, and the host reachable by name.
+ * Used whenever `containerNetwork` is unset or the runtime is runsc (user-defined
+ * Docker networks break gVisor's outbound DNS).
+ */
+export const DEFAULT_BRIDGE_ARGS: readonly string[] = [
+  "--add-host",
+  "host.docker.internal:host-gateway",
+];
+
+/**
+ * The Docker Desktop relaxation, gated behind `containerAllowUnconfined`.
+ * Named for the same reason as the two above — the round-trip probe must run
+ * the arm the real spawn would run on this host, weakening included.
+ */
+export const DOCKER_DESKTOP_UNCONFINED_ARGS: readonly string[] = [
+  "--security-opt",
+  "seccomp=unconfined",
+  "--security-opt",
+  "apparmor=unconfined",
+  "--cap-add",
+  "SYS_ADMIN",
+];
+
+/**
+ * The API host an inner container dials, as `API_URL`.
+ *
+ * A free function so `mercury preflight`'s round trip resolves it the way a
+ * real spawn does instead of restating the rule — a second implementation here
+ * would put the probe on a different endpoint than the turn it is vouching for.
+ *
+ * gVisor (runsc) cannot use Docker's embedded DNS (127.0.0.11 is unreachable
+ * from the gVisor network sandbox), so container-name hostnames do not resolve
+ * and the outer no longer joins docker0. `API_URL` becomes a dummy that mrctl
+ * ignores once `API_SOCKET` is set; it stays non-empty only so mrctl's presence
+ * assertion passes. runc/local keep using the real hostname.
+ */
+export function resolveContainerApiHost(config: AppConfig): string {
+  const configured = config.containerApiHost;
+  if (!configured) return "host.docker.internal";
+  if (config.containerRuntime !== "runsc") return configured;
+  return "localhost";
+}
+
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const PACKAGE_ROOT = path.join(__dirname, "../..");
 
@@ -1061,6 +1150,12 @@ export class AgentContainerRunner {
    * spawn, because the real run will produce its own, more specific error.
    */
   private sandboxBlockedDetail: string | undefined = undefined;
+  /**
+   * Set once the append-mode-under-OAuth warning has been logged. The condition
+   * is per-process configuration, not per-spawn, so repeating it on every turn
+   * would bury the one line that matters under its own noise.
+   */
+  private warnedAppendUnderOAuth = false;
 
   constructor(private readonly config: AppConfig) {
     this.validateImage();
@@ -1083,11 +1178,7 @@ export class AgentContainerRunner {
    * unchanged and keep using the real hostname.
    */
   private resolveApiHost(): string {
-    const configured = this.config.containerApiHost;
-    if (!configured) return "host.docker.internal";
-    if (this.config.containerRuntime !== "runsc") return configured;
-    // gVisor: dummy host — the real transport is the unix socket (API_SOCKET).
-    return "localhost";
+    return resolveContainerApiHost(this.config);
   }
 
   /** Set a background build state — currentImage() is resolved at each spawn. */
@@ -1124,35 +1215,75 @@ export class AgentContainerRunner {
     });
   }
 
+  /** Where the last successful pull is recorded, so a refresh is asked once. */
+  private imagePullRecordPath(): string {
+    return path.join(path.resolve(this.config.dataDir), IMAGE_PULL_RECORD_FILE);
+  }
+
+  /**
+   * Read the last pull record. Never throws — an unreadable or corrupt record
+   * is treated as "no boot ever recorded a pull", which refreshes. Refreshing
+   * on absence costs one pull; a wrong "current" costs a month of the wrong
+   * container.
+   */
+  private readImagePullRecord(): ImagePullRecord | null {
+    try {
+      const raw = fs.readFileSync(this.imagePullRecordPath(), "utf8");
+      const parsed = JSON.parse(raw) as Partial<ImagePullRecord>;
+      if (typeof parsed.version !== "string" || !parsed.version) return null;
+      if (typeof parsed.image !== "string" || !parsed.image) return null;
+      return { version: parsed.version, image: parsed.image };
+    } catch {
+      return null;
+    }
+  }
+
+  /**
+   * Record the version/reference pair that just pulled successfully.
+   *
+   * Only ever called after a pull that returned 0. A failed refresh
+   * deliberately leaves the record alone so the next boot asks again —
+   * recording a pull that did not happen is how a tag stays frozen while the
+   * bookkeeping says it is fresh.
+   */
+  private writeImagePullRecord(record: ImagePullRecord): void {
+    const file = this.imagePullRecordPath();
+    try {
+      fs.mkdirSync(path.dirname(file), { recursive: true });
+      fs.writeFileSync(file, `${JSON.stringify(record, null, 2)}\n`);
+    } catch (error) {
+      // Non-fatal: the cost of not recording is one extra pull next boot.
+      logger.warn("Could not record the agent image pull", {
+        file,
+        detail: error instanceof Error ? error.message : String(error),
+      });
+    }
+  }
+
   /**
-   * Ensure the agent image is available locally, pulling it if needed.
+   * Ensure the agent image is available locally, pulling it if needed — and
+   * re-pulling a floating tag whose host version has moved.
+   *
    * Should be called on startup before accepting work.
+   *
+   * The re-pull is the narrow half of release-gate R0.4. Without it a floating
+   * default (`ghcr.io/.../mercury-agent:latest`) meant "whatever this box
+   * happened to pull the first time": a host upgraded through npm kept
+   * yesterday's container, `/health` stayed 200, and nothing said so. See
+   * `image-refresh.ts` for the whole flow, why the decision looks the way it
+   * does, and why pinning the default to the host version is not this change.
    */
   async ensureImage(): Promise<void> {
-    const image = this.image;
-    const inspect = await execDocker(["image", "inspect", image], 10_000);
-    if (inspect.code === 0) {
-      logger.debug("Agent image found locally", { image });
-      return;
-    }
-    // Pull output is captured, not streamed: the HTTP server is already
-    // answering (warming) while this runs, and a synchronous inherit-stdio
-    // pull used to freeze it for up to five minutes.
-    logger.info("Agent image not found locally, pulling (can take minutes)", {
-      image,
+    await ensureAgentImage(this.image, {
+      exec: (args, timeoutMs) => execDocker(args, timeoutMs),
+      hostVersion: readHostVersion(PACKAGE_ROOT),
+      readRecord: () => this.readImagePullRecord(),
+      writeRecord: (record) => this.writeImagePullRecord(record),
+      log: {
+        info: (message, meta) => logger.info(message, meta),
+        warn: (message, meta) => logger.warn(message, meta),
+      },
     });
-    const pull = await execDocker(["pull", image], 300_000);
-    if (pull.code !== 0) {
-      const reason = pull.timedOut
-        ? "timed out after 300000ms"
-        : pull.stderr.trim().slice(-2000);
-      throw new Error(
-        `Failed to pull agent image: ${image}${reason ? ` (${reason})` : ""}\n` +
-          `Build it locally with: mercury build\n` +
-          `Or pull manually: docker pull ${image}`,
-      );
-    }
-    logger.info("Agent image pulled successfully", { image });
   }
 
   /**
@@ -1633,6 +1764,45 @@ export class AgentContainerRunner {
       : `mercury-${timestamp}-${id}`;
   }
 
+  /**
+   * Warn once when the container is about to run in append mode while carrying
+   * an Anthropic **OAuth** credential.
+   *
+   * `--append-system-prompt` keeps pi's own coding-agent preamble in the
+   * request, and Anthropic's OAuth gate fingerprints that preamble as a
+   * third-party app: every call is answered with 400 `Third-party apps now draw
+   * from your extra usage, not your plan limits`. The message names billing, so
+   * without this line an operator spends the outage reading their plan balance.
+   * An API key is not gated, which is why the credential — not just the flag —
+   * has to be in the condition.
+   *
+   * Warn, do not force. `override_pi_system_prompt: false` is something an
+   * operator wrote on purpose, and silently overriding it here would put a
+   * second copy of the rule on the host, where the container's own reading of
+   * `OVERRIDE_PI_SYSTEM_PROMPT` could then disagree with it.
+   *
+   * Called after `injectChainOAuthCredentials` so a chain-only Anthropic leg —
+   * whose token is pushed there, not by the primary-credential block — is
+   * covered too.
+   */
+  private warnIfAppendModeUnderOAuth(
+    envPairs: Array<{ key: string; value: string }>,
+    extraEnv: Record<string, string> | undefined,
+    spaceId: string,
+  ): void {
+    if (this.config.overridePiSystemPrompt) return;
+    if (this.warnedAppendUnderOAuth) return;
+    const usesOAuth =
+      envPairs.some((p) => p.key === "ANTHROPIC_OAUTH_TOKEN" && p.value) ||
+      Boolean(extraEnv?.ANTHROPIC_OAUTH_TOKEN);
+    if (!usesOAuth) return;
+    this.warnedAppendUnderOAuth = true;
+    logger.warn(
+      "override_pi_system_prompt=false with an Anthropic OAuth credential: pi's default preamble reaches the API and Anthropic's gate answers 400 \"Third-party apps now draw from your extra usage\" on every request. That is a classification error, not a quota one. Set agent.override_pi_system_prompt: true (or unset it to take the default).",
+      { spaceId },
+    );
+  }
+
   /**
    * Resolve each OAuth provider in the model chain from the host's auth.json
    * and append its credential to `envPairs` as the env var pi reads it from.
@@ -1656,11 +1826,19 @@ export class AgentContainerRunner {
     // Injected like `OAuthSpawnDeps` above, so a test can exercise the
     // refresh-failure branch without a token endpoint.
     resolveCredential: typeof getPiAuthCredential = getPiAuthCredential,
+    /**
+     * Providers the caller has already resolved. Asking twice would spend a
+     * second single-use refresh token and log the same finding at two levels —
+     * `getPiAuthCredential` coalesces *concurrent* callers, not sequential
+     * ones, so the caller has to say what it already did.
+     */
+    skip?: ReadonlySet<string>,
   ): Promise<void> {
     const providers = new Set(
       (this.config.resolvedModelChain ?? []).map((leg) => leg.provider),
     );
     for (const provider of providers) {
+      if (skip?.has(provider)) continue;
       const envVar = providerCredentialEnvVar(provider);
       if (!envVar) {
         if (hasOAuthEntry(authPath, provider)) {
@@ -1693,6 +1871,214 @@ export class AgentContainerRunner {
     }
   }
 
+  /**
+   * The chain this spawn will actually run, container-side.
+   *
+   * `runtime.ts` narrows `MODEL_CHAIN` to a single leg when the space pins a
+   * model, so the pin — not `resolvedModelChain[0]` — is what pi will use.
+   * Reading the assembled env rather than re-deriving the pin keeps this one
+   * answer with the spawn instead of a second guess at it.
+   */
+  private effectiveModelChain(
+    extraEnv: Record<string, string> | undefined,
+  ): ModelLeg[] {
+    const raw = extraEnv?.MODEL_CHAIN;
+    if (raw) {
+      try {
+        const parsed = JSON.parse(raw) as unknown;
+        if (Array.isArray(parsed)) {
+          const legs = parsed.filter(
+            (l): l is ModelLeg =>
+              Boolean(l) &&
+              typeof (l as ModelLeg).provider === "string" &&
+              typeof (l as ModelLeg).model === "string",
+          );
+          if (legs.length > 0) return legs;
+        }
+      } catch {
+        // Unparseable MODEL_CHAIN is runtime.ts's own JSON.stringify output, so
+        // this cannot normally happen; fall back to the configured chain rather
+        // than refuse on a shape nobody set by hand.
+      }
+    }
+    return this.config.resolvedModelChain ?? [];
+  }
+
+  /**
+   * Whether one leg has a credential in the env this spawn is about to carry.
+   *
+   * Names are container-side: the passthrough strips the `MERCURY_` prefix, and
+   * a `models.json` `"apiKey": "$GATEWAY_KEY"` is expanded by pi from
+   * `GATEWAY_KEY` inside the container. `missing` therefore reports the *host*
+   * names, which is what an operator sets.
+   */
+  private legCredentialStatus(
+    leg: ModelLeg,
+    present: (containerVar: string) => boolean,
+    readModelsJson: () => unknown,
+  ): { served: boolean; missing: string[] } {
+    // Anthropic accepts either form; every other provider has at most one var.
+    const vars =
+      leg.provider === "anthropic"
+        ? ["ANTHROPIC_API_KEY", "ANTHROPIC_OAUTH_TOKEN"]
+        : [providerCredentialEnvVar(leg.provider)].filter((v): v is string =>
+            Boolean(v),
+          );
+    if (vars.some(present)) return { served: true, missing: [] };
+
+    // Only a leg whose env lookup came up empty is worth a disk read, so the
+    // usual spawn never opens models.json at all.
+    const modelsJson = readModelsJson();
+    const refs = modelsJsonEnvRefs(modelsJson, leg.provider);
+    if (refs.length > 0) {
+      const missing = refs.filter((ref) => !present(ref));
+      return {
+        served: missing.length === 0,
+        missing: missing.map(hostEnvVarForModelsJsonRef),
+      };
+    }
+    // A provider defined in models.json with no `$VAR` at all is a keyless
+    // endpoint the operator configured on purpose (a local model, an open
+    // gateway). There is no credential to be missing, so nothing may refuse
+    // over it — absence of a *requirement* is not absence of a guard input.
+    if (modelsJsonDefinesProvider(modelsJson, leg.provider)) {
+      return { served: true, missing: [] };
+    }
+    return { served: false, missing: vars.map((v) => `MERCURY_${v}`) };
+  }
+
+  /**
+   * Fail fast when the leg this run will use has no credential and no other leg
+   * can carry it either.
+   *
+   * The refusal used to be Anthropic-only —
+   * `if (!hasAnthropicKey && this.config.modelProvider === "anthropic")` — so a
+   * chain whose first leg was a `models.json` gateway or `github-copilot` got
+   * no host-side check at all: the container started, pi exited 1 with "No API
+   * key found", and the caller was told to try again while the real diagnosis
+   * sat in a container log.
+   *
+   * Two things this deliberately does **not** do:
+   *
+   * - It does not refuse when a *later* leg is served. `MODEL_CHAIN` exists so
+   *   another leg can carry the turn, which is why
+   *   `injectChainOAuthCredentials` only warns per leg. Only "the first leg has
+   *   nothing and no leg does" is a dead run. A space that pins a model gets a
+   *   one-leg chain, so a pinned unserved leg does refuse — correctly, there is
+   *   no fallback to wait for.
+   * - It does not re-implement credential resolution. The env it reads is the
+   *   env the container gets, after every injection above; the provider→var
+   *   mapping is `providerCredentialEnvVar`; the `models.json` `$VAR` lookup is
+   *   the one `mercury preflight`'s `credential.first-leg` check uses.
+   */
+  private assertChainCredential(
+    envPairs: Array<{ key: string; value: string }>,
+    extraEnv: Record<string, string> | undefined,
+    globalDir: string,
+    spaceId: string,
+    /**
+     * Why the Anthropic leg is unserved, when the block above found out —
+     * a corrupt blob, a refresh failure, or nothing on file. Used verbatim so
+     * an Anthropic box keeps the diagnosis it has always had instead of the
+     * generic "set MERCURY_… on the host".
+     */
+    anthropicDetail?: string,
+  ): void {
+    const legs = this.effectiveModelChain(extraEnv);
+    if (legs.length === 0) return;
+
+    const set = new Set<string>();
+    for (const pair of envPairs) if (pair.value) set.add(pair.key);
+    for (const [key, value] of Object.entries(extraEnv ?? {})) {
+      if (value) set.add(key);
+    }
+    const present = (name: string): boolean => set.has(name);
+
+    // Read only when some leg's env lookup came up empty — the happy path
+    // never touches the disk.
+    let modelsJson: unknown;
+    let modelsJsonRead = false;
+    const readModelsJson = (): unknown => {
+      if (modelsJsonRead) return modelsJson;
+      modelsJsonRead = true;
+      const file = path.join(globalDir, "models.json");
+      try {
+        const { parsed, error } = parseModelsJson(
+          fs.readFileSync(file, "utf8"),
+        );
+        if (error) {
+          logger.warn("models.json is not readable as JSON, ignoring", {
+            file,
+            detail: error,
+          });
+        }
+        modelsJson = parsed;
+      } catch (error) {
+        const code = (error as { code?: string } | null)?.code;
+        if (code !== "ENOENT") {
+          logger.warn("Could not read models.json", {
+            file,
+            detail: error instanceof Error ? error.message : String(error),
+          });
+        }
+        modelsJson = null;
+      }
+      return modelsJson;
+    };
+
+    const first = legs[0];
+    if (!first) return;
+    const firstStatus = this.legCredentialStatus(
+      first,
+      present,
+      readModelsJson,
+    );
+    if (firstStatus.served) return;
+
+    const servedLater = legs
+      .slice(1)
+      .some(
+        (leg) => this.legCredentialStatus(leg, present, readModelsJson).served,
+      );
+    if (servedLater) {
+      // injectChainOAuthCredentials already logged why this leg is unserved.
+      logger.warn(
+        `Model chain leg "${first.provider}:${first.model}" starts without a credential; a later leg will have to carry this run.`,
+        { spaceId, provider: first.provider },
+      );
+      return;
+    }
+
+    // "Set it on the host" is the wrong instruction when the operator already
+    // did and the boundary dropped it — that is a different failure with a
+    // different fix, and telling someone to do again what they already did is
+    // how an outage gets long. Which boundary depends on the mode, so the two
+    // are worded apart rather than blamed on `claimed` either way.
+    const dropped = firstStatus.missing.filter((name) => process.env[name]);
+    const plural = dropped.length > 1;
+    const droppedNames = dropped.join(" and ");
+    const named =
+      dropped.length > 0
+        ? this.config.containerEnvPassthrough === "claimed"
+          ? `${droppedNames} ${plural ? "are" : "is"} set on the host but env_passthrough is "claimed", which forwards only the fixed model-provider credentials — the container never receives ${plural ? "them" : "it"}. Set agent.env_passthrough: all, or have an extension declare ${droppedNames}`
+          : `${droppedNames} ${plural ? "are" : "is"} set on the host but did not reach this container — the name is either blocked outright (BLOCKED_ENV_VARS) or claimed by an extension this caller may not use, so it is injected only behind that permission gate`
+        : firstStatus.missing.length > 0
+          ? `set ${firstStatus.missing.join(" or ")} on the host`
+          : `pi reads no credential env var for "${first.provider}" and neither auth.json nor models.json keys it — define it in models.json with a $VAR apiKey, or use a provider Mercury can pass a credential for`;
+    const detail =
+      first.provider === "anthropic" && anthropicDetail
+        ? anthropicDetail
+        : `no credential for model leg ${first.provider}:${first.model} and no other chain leg has one — ${named}`;
+    logger.error(`Refusing to start container: ${detail}`, {
+      spaceId,
+      provider: first.provider,
+      model: first.model,
+      chainLength: legs.length,
+      missing: firstStatus.missing,
+    });
+    throw ContainerError.noCredentials(spaceId, detail);
+  }
+
   async reply(input: {
     spaceId: string;
     spaceWorkspace: string;
@@ -1837,11 +2223,27 @@ export class AgentContainerRunner {
         input.extraEnv?.ANTHROPIC_API_KEY ||
           input.extraEnv?.ANTHROPIC_OAUTH_TOKEN,
       );
-    if (!hasAnthropicKey && this.config.modelProvider === "anthropic") {
+    // Why the chain and not `config.modelProvider`: `modelProvider` defaults to
+    // "anthropic" and is *independent* of `model.chain`, so a box configured
+    // entirely with a gateway chain still reported "anthropic" here — and this
+    // block refused every container on it over a credential nothing was going
+    // to use. That is the 2026-08-31 "gateway box refuses every container"
+    // shape. The question is which providers this run can actually reach.
+    // Only the *first* leg: a later anthropic leg is `injectChainOAuthCredentials`'s
+    // job, and asking twice would spend a second single-use refresh token and
+    // log the same finding at two levels.
+    const anthropicIsFirstLeg =
+      this.effectiveModelChain(input.extraEnv)[0]?.provider === "anthropic";
+    // Diagnosis kept for `assertChainCredential` below rather than thrown here:
+    // an unserved anthropic leg is only fatal when no other leg can carry the
+    // run, and this is the one place that knows *why* anthropic is unserved.
+    let anthropicCredentialDetail: string | undefined;
+    const askedAnthropic = !hasAnthropicKey && anthropicIsFirstLeg;
+    if (askedAnthropic) {
       const resolvedAuthPath =
         this.config.authPath ?? path.join(globalDir, "auth.json");
       const piAuth = await getPiAuthCredential({
-        provider: this.config.modelProvider,
+        provider: "anthropic",
         authPath: resolvedAuthPath,
       });
       if (piAuth.status === "ok") {
@@ -1850,10 +2252,7 @@ export class AgentContainerRunner {
           value: piAuth.apiKey,
         });
       } else {
-        // Fail fast: without a credential, pi inside the container exits 1
-        // ("No API key found for anthropic") after a full container start,
-        // and the user gets a misleading "try again" message.
-        const detail = oauthBlobCorrupt
+        anthropicCredentialDetail = oauthBlobCorrupt
           ? "MERCURY_ANTHROPIC_OAUTH_TOKEN holds a corrupt credential blob — re-provision it or set MERCURY_ANTHROPIC_API_KEY"
           : piAuth.status === "refresh-failed"
             ? `Anthropic OAuth refresh failed for ${resolvedAuthPath} — ${describeRefreshFailure(piAuth)}${
@@ -1862,14 +2261,16 @@ export class AgentContainerRunner {
                   : ". Run mercury auth login from the project directory that owns that file, or set MERCURY_ANTHROPIC_API_KEY"
               }`
             : `no Anthropic credential configured (checked ${resolvedAuthPath}) — run mercury auth login or set MERCURY_ANTHROPIC_API_KEY / MERCURY_ANTHROPIC_OAUTH_TOKEN`;
-        logger.error(`Refusing to start container: ${detail}`, {
-          spaceId: input.spaceId,
-          authPath: resolvedAuthPath,
-          ...(piAuth.status === "refresh-failed"
-            ? { reason: piAuth.reason ?? "unknown", upstream: piAuth.detail }
-            : {}),
-        });
-        throw ContainerError.noCredentials(input.spaceId, detail);
+        logger.warn(
+          `Anthropic leg has no usable credential: ${anthropicCredentialDetail}`,
+          {
+            spaceId: input.spaceId,
+            authPath: resolvedAuthPath,
+            ...(piAuth.status === "refresh-failed"
+              ? { reason: piAuth.reason ?? "unknown", upstream: piAuth.detail }
+              : {}),
+          },
+        );
       }
     }
 
@@ -1882,6 +2283,27 @@ export class AgentContainerRunner {
       input.extraEnv,
       this.config.authPath ?? path.join(globalDir, "auth.json"),
       input.spaceId,
+      undefined,
+      // The block above already asked auth.json for anthropic and either
+      // pushed the token or recorded why it could not. Asking again would
+      // spend a second single-use refresh token and warn twice for one event.
+      askedAnthropic ? new Set(["anthropic"]) : undefined,
+    );
+
+    // Fail fast for every provider, not just anthropic. Runs after every
+    // injection above so it reads the env the container will actually carry.
+    this.assertChainCredential(
+      passthroughEnvPairs,
+      input.extraEnv,
+      globalDir,
+      input.spaceId,
+      anthropicCredentialDetail,
+    );
+
+    this.warnIfAppendModeUnderOAuth(
+      passthroughEnvPairs,
+      input.extraEnv,
+      input.spaceId,
     );
 
     const envPairs = [
@@ -1944,8 +2366,15 @@ export class AgentContainerRunner {
         value: JSON.stringify(this.config.resolvedModelChainCapabilities),
       },
       {
+        // The container honours "false"/"0" as append mode — the mode the
+        // OAuth gate rejects — so the only path to the literal "false" must be
+        // a value the host positively read as an opt-out. The field is typed
+        // `boolean` (`overridePiSystemPromptFromEnv` in config.ts rejects
+        // everything that is not an opt-out before it gets here), so this is
+        // equivalent to a plain ternary today; the explicit `=== false` keeps
+        // it that way if the field ever widens.
         key: "OVERRIDE_PI_SYSTEM_PROMPT",
-        value: this.config.overridePiSystemPrompt ? "true" : "false",
+        value: this.config.overridePiSystemPrompt === false ? "false" : "true",
       },
       { key: "BOT_USERNAME", value: this.config.botUsername },
     ].filter((x): x is { key: string; value: string } => Boolean(x.value));
@@ -2033,7 +2462,7 @@ export class AgentContainerRunner {
       // embedded resolver at 127.0.0.11 is unreachable from gVisor). Inner
       // containers keep docker0 for outbound DNS/HTTPS; the inner→outer API
       // callback rides the per-agent unix socket (API_SOCKET), not docker0.
-      args.push("--add-host", "host.docker.internal:host-gateway");
+      args.push(...DEFAULT_BRIDGE_ARGS);
     }
 
     // Per-message IO dir — the detached reply channel. Mirrors the global/spaces
@@ -2094,16 +2523,7 @@ export class AgentContainerRunner {
       // Restores full Docker hardening (SYS_ADMIN relaxation not required).
       // CONTAINER_RUNTIME=runsc is passed explicitly (stripped prefix) so container-entry
       // skips the bwrap spawn path.
-      args.push(
-        "--runtime=runsc",
-        "--cap-drop=ALL",
-        "--security-opt=no-new-privileges",
-        "--memory=2g",
-        "--cpus=2",
-        "--pids-limit=512",
-        "-e",
-        "CONTAINER_RUNTIME=runsc",
-      );
+      args.push(...RUNSC_HARDENING_ARGS);
     } else if (
       this.config.containerBwrapDockerCompat ||
       (await isDockerDesktop())
@@ -2141,14 +2561,7 @@ export class AgentContainerRunner {
             "MERCURY_CONTAINER_RUNTIME=runsc avoids this on Linux hosts.",
           { spaceId: input.spaceId },
         );
-        args.push(
-          "--security-opt",
-          "seccomp=unconfined",
-          "--security-opt",
-          "apparmor=unconfined",
-          "--cap-add",
-          "SYS_ADMIN",
-        );
+        args.push(...DOCKER_DESKTOP_UNCONFINED_ARGS);
       }
     } else if (this.sandboxBlockedDetail) {
       // Default Linux shape, and the boot probe already proved bwrap cannot
@@ -2246,14 +2659,22 @@ export class AgentContainerRunner {
       // Harvest before delete, and from inside cleanupIo rather than beside each
       // call of it — every exit path routes through here, including the timeout
       // and crash paths, which are the ones a trace exists to explain.
-      if (this.config.containerTraceRuns) {
-        const dest = harvestRunTrace(
-          ioLocalDir,
-          this.config.dataDir,
-          containerName,
-        );
-        if (dest) logger.info("Harvested agent run trace", { trace: dest });
-      }
+      //
+      // Unconditional, not gated on `containerTraceRuns`. That flag gates what
+      // the *container* writes (`TRACE_RUNS=1` → the full pi transcript, which
+      // is why it is off by default), but the agent also writes counts-only
+      // diagnostics into the same file on runs nobody thought to trace —
+      // `history_budget_dropped_turns` is the first (`container-entry.ts`
+      // `traceEvent`). Gating the harvest here would delete them with the IO
+      // dir and put the event back where the bug found it: a log nobody reads.
+      // Nothing is created when the file is absent — `harvestRunTrace` returns
+      // null before it touches the destination.
+      const dest = harvestRunTrace(
+        ioLocalDir,
+        this.config.dataDir,
+        containerName,
+      );
+      if (dest) logger.info("Harvested agent run trace", { trace: dest });
       try {
         fs.rmSync(ioLocalDir, { recursive: true, force: true });
       } catch {