fix(daemon): preserve recovered worker registry authority

[sethkarten]

Summary

• Capture the supervisor registry directory once as host authority.
• Propagate it to recovered workers after caller and inherited environments.
• Cover untrusted launch-environment override attempts.

Validation

• node_modules/.bin/biome check packages/coding-agent/src/modes/daemon/daemon-supervisor-ownership.ts packages/coding-agent/src/modes/daemon/daemon-supervisor.ts packages/coding-agent/test/daemon-supervisor-monitor.test.ts
• node_modules/.bin/vitest --run packages/coding-agent/test/daemon-supervisor-monitor.test.ts packages/coding-agent/test/daemon-session-list.test.ts packages/coding-agent/test/saved-session-info.test.ts (104 passed)
• node_modules/.bin/tsgo --noEmit blocked by a pre-existing missing invokeHostRequest export in packages/coding-agent/test/sdk-mcp-boundary.test.ts.

Note

Preserve daemon supervisor registry authority across worker spawning

• DaemonSupervisor now captures a single registry directory at startup via getDaemonSupervisorRegistryDir() and stores it as supervisorRegistryDir.
• When spawning worker processes, the supervisor injects DAEMON_SUPERVISOR_REGISTRY_DIR_ENV set to this.supervisorRegistryDir after merging all other env vars, preventing workers from overriding the registry path.
• DAEMON_SUPERVISOR_REGISTRY_DIR_ENV and getDaemonSupervisorRegistryDir are exported from daemon-supervisor-ownership.ts so the supervisor and tests can import them directly.
• Behavioral Change: all spawned workers are now forced to use the supervisor's registry directory regardless of what launchEnv provides.

^{Macroscope summarized ed2552c.}

Final reconciled validation

• Head: f9f0d7615e1cca807c4faa49413cc52a9c1f31f5
• Core-09 reconciled with final Core-08 parent and retains recovered-worker registry ownership.
• Non-writing Biome over the full Core-05–Core-09 changed-path union: pass (29 files)
• Root tsgo --noEmit: pass
• Configured MCP, lifecycle, catalog, and registry regressions: 16 files, 293/293 tests pass under sanitized RLM_/PRIME_AGENT_ environment
• git diff --check: pass; final worktree clean

---

Note

Medium Risk
Touches daemon ownership, startup fencing, and worker spawn env—core process coordination—but the change is narrow and covered by supervisor monitor tests.

Overview
Fixes lost supervisor registry authority when workers are relaunched from recovery metadata that can carry an untrusted launchEnv.

DaemonSupervisor now captures the registry directory once at construction (getDaemonSupervisorRegistryDir) and uses that same path for startup fencing, ownership acquisition, and every worker spawn. On launch, it sets PRIME_AGENT_INTERNAL_DAEMON_SUPERVISOR_REGISTRY_DIR after inherited process.env and caller launchEnv, so neither can redirect workers to a different registry.

daemon-supervisor-ownership exports the env constant and renames the internal resolver to getDaemonSupervisorRegistryDir for shared use. Tests assert recovered relaunches still receive the supervisor’s registry dir and do not persist the override in the worker descriptor.

^{Reviewed by Cursor Bugbot for commit ed2552c. Bugbot is set up for automated code reviews on this repo. Configure here.}

[sethkarten]

Superseded by #1336 as part of the physical Core/MCP stack split. The replacement preserves this PR’s reviewed semantic delta on the corrected shared #1243 foundation. Closing this PR to avoid duplicate review; branch retained for provenance.