From 2b8f55deb695a8392be879862a32b3f4d1a39cb1 Mon Sep 17 00:00:00 2001
From: ejclaw <phj1081@gmail.com>
Date: Sat, 11 Apr 2026 08:20:05 +0900
Subject: [PATCH] runtime: centralize unsafe paired mode checks

---
 src/agent-runner.ts                  | 5 +++--
 src/message-agent-executor-target.ts | 5 +++--
 src/paired-execution-context.ts      | 8 +++++---
 3 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/src/agent-runner.ts b/src/agent-runner.ts
index 98b1806..0f4fb12 100644
--- a/src/agent-runner.ts
+++ b/src/agent-runner.ts
@@ -2,6 +2,8 @@ import { ChildProcess, spawn } from 'child_process';
 import fs from 'fs';
 import path from 'path';
 
+import { isUnsafeHostPairedModeEnabled } from 'ejclaw-runners-shared';
+
 /**
  * Agent Process Runner for EJClaw
  * Spawns agent execution as direct host processes and handles IPC.
@@ -59,8 +61,7 @@ export async function runAgentProcess(
   onOutput?: (output: AgentOutput) => Promise<void>,
   envOverrides?: Record<string, string>,
 ): Promise<AgentOutput> {
-  const unsafeHostPairedMode =
-    envOverrides?.EJCLAW_UNSAFE_HOST_PAIRED_MODE === '1';
+  const unsafeHostPairedMode = isUnsafeHostPairedModeEnabled(envOverrides);
 
   // ── Host process mode (owner) ───────────────────────────────────
   const startTime = Date.now();
diff --git a/src/message-agent-executor-target.ts b/src/message-agent-executor-target.ts
index b0b794d..c217784 100644
--- a/src/message-agent-executor-target.ts
+++ b/src/message-agent-executor-target.ts
@@ -1,6 +1,8 @@
 import fs from 'fs';
 import path from 'path';
 
+import { isUnsafeHostPairedModeEnabled } from 'ejclaw-runners-shared';
+
 import { listAvailableGroups } from './available-groups.js';
 import {
   ARBITER_AGENT_TYPE,
@@ -115,8 +117,7 @@ export async function prepareMessageAgentExecutionTarget(
       ? { ...group, agentType: effectiveAgentType }
       : group;
   const isClaudeCodeAgent = effectiveAgentType === 'claude-code';
-  const unsafeHostPairedMode =
-    process.env.EJCLAW_UNSAFE_HOST_PAIRED_MODE === '1';
+  const unsafeHostPairedMode = isUnsafeHostPairedModeEnabled();
   const forceFreshClaudeReviewerSession =
     reviewerMode && isClaudeCodeAgent && unsafeHostPairedMode;
   const shouldPersistSession =
diff --git a/src/paired-execution-context.ts b/src/paired-execution-context.ts
index d769808..8ed7150 100644
--- a/src/paired-execution-context.ts
+++ b/src/paired-execution-context.ts
@@ -2,7 +2,10 @@ import crypto from 'crypto';
 import fs from 'fs';
 import path from 'path';
 
-import { buildPairedReadonlyRuntimeEnvOverrides } from 'ejclaw-runners-shared';
+import {
+  buildPairedReadonlyRuntimeEnvOverrides,
+  isUnsafeHostPairedModeEnabled,
+} from 'ejclaw-runners-shared';
 
 import {
   ARBITER_DEADLOCK_THRESHOLD,
@@ -322,8 +325,7 @@ export function preparePairedExecutionContext(args: {
     EJCLAW_PAIRED_TASK_ID: task.id,
     EJCLAW_PAIRED_ROLE: roomRoleContext.role,
   };
-  const unsafeHostPairedMode =
-    process.env.EJCLAW_UNSAFE_HOST_PAIRED_MODE === '1';
+  const unsafeHostPairedMode = isUnsafeHostPairedModeEnabled();
 
   if (workspace?.workspace_dir) {
     envOverrides.EJCLAW_WORK_DIR = workspace.workspace_dir;