fix(host): answer review of the platform host environment change

Redaction patterns come from the command host, the maestro child reads its
own environment without a working-directory lookup, local ~ install sources
expand against the host environment, and the runner launch resolves its host
inside the try that closes its log descriptor.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Author: thymikee

packages/capture-kit/src/recording/swift-cache.ts

@@ -42,7 +42,8 @@ export function buildRecordingScriptPathCandidates(
 
 /**
  * Resolves one recording helper script: checkout, built package, or working-directory fallback.
- * The caller names the project root it trusts, so this module stays free of host metadata lookup.
+ * The caller names the project root it trusts, so this module stays free of host metadata lookup;
+ * the working directory defaults to the command host's.
  */
 export function resolveRecordingScriptPath(
   scriptName: string,

packages/daemon/src/server/http/http-server-proxy.test.ts

@@ -190,7 +190,7 @@ test('proxy enforces public-only Maestro HTTP policy on a local daemon', async (
             headers: {},
             publicNetworkOnly: request.internal?.publicNetworkOnly === true,
           },
-          process.env,
+          env,
         ),
       };
     },

packages/maestro/src/daemon-port/run-script-http-child.ts

@@ -1,13 +1,12 @@
 import { readFileSync } from 'node:fs';
 import { pathToFileURL } from 'node:url';
-import { captureHostEnvironment } from '@agent-device/host-kit/process';
 import type { RunScriptHttpRequest } from './run-script-http.ts';
 import { executeRunScriptHttpRequest } from './run-script-http.ts';
 
 export async function runScriptHttpChild(): Promise<void> {
   const response = await executeRunScriptHttpRequest(
     JSON.parse(readFileSync(0, 'utf8')) as RunScriptHttpRequest,
-    captureHostEnvironment(process).env,
+    process.env,
   );
   process.stdout.write(JSON.stringify(response));
 }

packages/platform-apple/src/runner/runner-process-launch.ts

@@ -59,9 +59,9 @@ export function launchRunnerProcess(input: LaunchRunnerProcessInput): LaunchedRu
     } catch {}
   });
   const listenerReady = createRunnerListenerReadySignal();
-  // The runner outlives this process, so it gets its environment and directory as plain values.
-  const { env, cwd } = commandHostEnvironment();
   try {
+    // The runner outlives this process, so it gets its environment and directory as plain values.
+    const { env, cwd } = commandHostEnvironment();
     const launched = runCmdBackground(
       'xcodebuild',
       [

packages/provision-kit/src/install-source.ts

@@ -84,8 +84,8 @@ export async function materializeInstallablePath(
   }
 }
 
-function expandSourcePath(inputPath: string): string {
-  return expandUserHomePath(inputPath);
+function expandSourcePath(inputPath: string, env: NodeJS.ProcessEnv): string {
+  return expandUserHomePath(inputPath, { env });
 }
 
 async function materializeLocalSource(
@@ -94,7 +94,7 @@ async function materializeLocalSource(
 ): Promise<MaterializeLocalSourceResult> {
   if (source.kind === 'path') {
     return {
-      localPath: expandSourcePath(source.path),
+      localPath: expandSourcePath(source.path, options.environment),
       cleanup: async () => {},
     };
   }

src/platform-runtime-app-log-output.test.ts

@@ -1,6 +1,7 @@
 import fs from 'node:fs';
 
 import path from 'node:path';
+import { withCommandHost } from '@agent-device/host-kit/command';
 import { afterEach, expect, test } from 'vitest';
 import { openAppLogOutput, readAppLogOutputTail } from './platform-runtime-app-log-output.ts';
 import { bindTestCommandHost, mkdtempForTestSync } from '@agent-device/test-kit';
@@ -94,3 +95,25 @@ function finalSymlinkFixture(label: string) {
   fs.symlinkSync(outsidePath, outputPath);
   return { sessionsDir, outputPath, outsidePath };
 }
+
+test('redacts with the patterns of the command host, not the process', async () => {
+  const root = mkdtempForTestSync('agent-device-app-log-redact-');
+  roots.push(root);
+  const sessionsDir = path.join(root, 'sessions');
+  const outputPath = path.join(sessionsDir, 'one', 'app.log');
+  fs.mkdirSync(path.dirname(outputPath), { recursive: true });
+
+  await withCommandHost(
+    {
+      host: { env: { AGENT_DEVICE_APP_LOG_REDACT_PATTERNS: 'secret-\\d+' }, cwd: root },
+      requestEnv: undefined,
+    },
+    async () => {
+      const sink = await openAppLogOutput(sessionsDir, outputPath);
+      await sink.write('token secret-42 leaked\n');
+      await sink[Symbol.asyncDispose]();
+    },
+  );
+
+  expect(fs.readFileSync(outputPath, 'utf8')).toBe('token [REDACTED] leaked\n');
+});

src/platform-runtime-app-log-output.ts

@@ -23,7 +23,8 @@ export async function openAppLogOutput(
   stream.on('error', (error) => {
     streamError ??= error;
   });
-  const patterns = redactionPatterns();
+  const { env } = commandHostEnvironment();
+  const patterns = redactionPatterns(env);
   let pending = '';
   let writes = Promise.resolve();
   let disposal: Promise<void> | undefined;
@@ -90,8 +91,8 @@ function requireManagedOutputPath(sessionsDir: string, pathname: string): string
   });
 }
 
-function redactionPatterns(): RegExp[] {
-  return (process.env.AGENT_DEVICE_APP_LOG_REDACT_PATTERNS ?? '')
+function redactionPatterns(env: NodeJS.ProcessEnv): RegExp[] {
+  return (env.AGENT_DEVICE_APP_LOG_REDACT_PATTERNS ?? '')
     .split(',')
     .map((part) => part.trim())
     .filter(Boolean)