fix(coding-agent): secure resident ACP recovery

[sethkarten]

Summary

• keep reattachable ACP sessions resident while leaving --no-session runs client-owned
• recover failed resident workers only from a fresh client-supplied launch environment
• strip credential-bearing environment and runtime configuration before durable persistence
• preserve safe recovery settings, supervisor ownership, and registry identity across restarts
• reap crashed-worker orphans and detached children during lifecycle teardown

Behavioral contract

A resident worker that cannot be safely recovered remains failed until an authorized local client supplies fresh transient launch context. Durable descriptors remain recovery recipes, not credential stores.

Stack

This is the parent of #1239. Merge #1236 first, then retarget and merge #1239.

Validation

• required CI and CodeQL checks pass at dc6f1a8a774f6295f4591e2f01422090b57fa832
• focused coverage includes resident ACP lifecycle, credential sanitization, recovery fencing, PID reuse, descriptor conflicts, and orphan cleanup
• no paid or live evaluation is part of GitHub CI

---

Note

High Risk
Changes authentication and daemon worker recovery in security-sensitive paths; existing on-disk descriptors may lose stored env vars and need clients to re-supply credentials on reconnect.

Overview
Resident ACP sessions with a session file stay resident after stdio disconnect; --no-session ACP and non-ACP modes remain client-owned. Interactive startup uses isClientOwnedDaemonSession instead of treating all sessions as client-owned.

Credential hygiene: Worker descriptors and supervisor config are sanitized before disk write via sanitizeAgentSessionRuntimeConfigForDurableStorage and filterPersistedDaemonLaunchEnv (allowlisted non-secret launch keys only). Loaded descriptors are re-sanitized and rewritten when stale secrets are found.

Fail-closed recovery: Ownerless resident workers that crash no longer auto-relaunch from descriptor or supervisor ambient env—they enter failed until a local client resumes with a fresh launchEnv. reuseWorkerForCreate single-flights concurrent resumes and consumes one-shot recovery credentials after success or exhaustion. Failed resident attach falls through to create with fresh launch env.

Daemon shutdown kills tracked detached children; orphan reaping is split for dead workers without credential-based replacement.

^{Reviewed by Cursor Bugbot for commit 2ab4ff1. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Secure resident ACP daemon worker recovery by filtering secrets from persisted descriptors

• Adds sanitizeAgentSessionRuntimeConfigForDurableStorage in agent-session-config.ts to strip credential-like fields before writing configs to disk; applied in supervisor startup, worker persistence, and descriptor loading.
• Adds filterPersistedDaemonLaunchEnv in daemon-protocol.ts with an explicit allowlist of non-secret env keys permitted in resident worker descriptors.
• Resident worker recovery now fails closed when no fresh credentials are available: the worker is marked failed and waits for a client to supply a launchEnv on the next resume request instead of retrying with stale or absent env.
• isClientOwnedDaemonSession in main.ts makes ACP sessions with a session file resident by default; --no-session keeps them client-owned.
• Risk: existing resident worker descriptors with credentials persisted will have those fields stripped on next supervisor load, requiring clients to supply fresh launchEnv for recovery.

^{Macroscope summarized 2ab4ff1.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit f8e20fc. Configure here.}

[macroscopeapp]

🔴 Critical core/agent-session-config.ts:146

Extension credentials such as --provider-secret-key=... remain in the durable worker descriptor instead of being redacted. After normalization, provider-secret-key becomes providersecretkey, which is neither an exact secret field nor matched by the suffix regexp; add secretkey to that regexp so composed extension credential names are removed before JSON persistence.

🚀 Reply "fix it for me" or copy this AI Prompt for your agent:

In file @packages/coding-agent/src/core/agent-session-config.ts around line 146:

Extension credentials such as `--provider-secret-key=...` remain in the durable worker descriptor instead of being redacted. After normalization, `provider-secret-key` becomes `providersecretkey`, which is neither an exact secret field nor matched by the suffix regexp; add `secretkey` to that regexp so composed extension credential names are removed before JSON persistence.

Evidence trail:
packages/coding-agent/src/cli/daemon-command.ts:613-616 (2ab4ff1); packages/coding-agent/src/core/agent-session-config.ts:56-94,96-148 (2ab4ff1); packages/coding-agent/src/modes/daemon/daemon-supervisor.ts:1035-1041 (2ab4ff1)