fix(daemon): preserve recovered worker registry authority

[sethkarten]

Summary

• Capture the supervisor registry directory once as host authority.
• Propagate it to recovered workers after caller and inherited environments.
• Cover untrusted launch-environment override attempts.

Validation

• node_modules/.bin/biome check packages/coding-agent/src/modes/daemon/daemon-supervisor-ownership.ts packages/coding-agent/src/modes/daemon/daemon-supervisor.ts packages/coding-agent/test/daemon-supervisor-monitor.test.ts
• node_modules/.bin/vitest --run packages/coding-agent/test/daemon-supervisor-monitor.test.ts packages/coding-agent/test/daemon-session-list.test.ts packages/coding-agent/test/saved-session-info.test.ts (104 passed)
• node_modules/.bin/tsgo --noEmit blocked by a pre-existing missing invokeHostRequest export in packages/coding-agent/test/sdk-mcp-boundary.test.ts.

Note

Preserve supervisor registry directory across recovered daemon workers

• DaemonSupervisor now captures its registry directory at startup into supervisorRegistryDir and injects it as PRIME_AGENT_INTERNAL_DAEMON_SUPERVISOR_REGISTRY_DIR into every spawned worker's environment, overriding any caller-supplied value.
• This ensures recovered workers use the same registry directory as their supervisor, fixing a bug where authority could be lost after recovery.
• getDaemonSupervisorRegistryDir is exported from daemon-supervisor-ownership.ts so the supervisor and tests can reference it directly.
• Behavioral Change: the registry dir env var set in launchEnv is now always overridden by the supervisor's chosen directory.

^{Macroscope summarized d2c4920.}

Final reconciled validation

• Head: f9f0d7615e1cca807c4faa49413cc52a9c1f31f5
• Core-09 reconciled with final Core-08 parent and retains recovered-worker registry ownership.
• Non-writing Biome over the full Core-05–Core-09 changed-path union: pass (29 files)
• Root tsgo --noEmit: pass
• Configured MCP, lifecycle, catalog, and registry regressions: 16 files, 293/293 tests pass under sanitized RLM_/PRIME_AGENT_ environment
• git diff --check: pass; final worktree clean

---

Note

Medium Risk
Touches daemon supervisor ownership and worker spawn env, which are security-sensitive for multi-process coordination; scope is narrow and covered by new regression tests.

Overview
Fixes daemon recovery so recovered session workers stay on the same supervisor ownership registry as their supervisor instead of drifting to a different (or attacker-supplied) directory.

DaemonSupervisor now captures supervisorRegistryDir once at construction via getDaemonSupervisorRegistryDir() and threads it through startup (waitForDaemonStartupFence, acquireDaemonSupervisorOwnership). Every worker spawn sets PRIME_AGENT_INTERNAL_DAEMON_SUPERVISOR_REGISTRY_DIR after inherited and caller launchEnv, so a persisted or untrusted registry path in launchEnv cannot override host authority. daemon-supervisor-ownership exports the env constant and renames the internal resolver to getDaemonSupervisorRegistryDir for reuse in tests and the supervisor.

Tests record spawn env and assert both initial and recovered launches receive the supervisor’s registry dir while launchEnv does not retain the override. mcp-probe.ts is a formatting-only change.

^{Reviewed by Cursor Bugbot for commit d2c4920. Bugbot is set up for automated code reviews on this repo. Configure here.}