runtime: centralize unsafe paired mode checks

src/agent-runner.ts

@@ -2,6 +2,8 @@ import { ChildProcess, spawn } from 'child_process';
 import fs from 'fs';
 import path from 'path';
 
+import { isUnsafeHostPairedModeEnabled } from 'ejclaw-runners-shared';
+
 /**
  * Agent Process Runner for EJClaw
  * Spawns agent execution as direct host processes and handles IPC.
@@ -59,8 +61,7 @@ export async function runAgentProcess(
   onOutput?: (output: AgentOutput) => Promise<void>,
   envOverrides?: Record<string, string>,
 ): Promise<AgentOutput> {
-  const unsafeHostPairedMode =
-    envOverrides?.EJCLAW_UNSAFE_HOST_PAIRED_MODE === '1';
+  const unsafeHostPairedMode = isUnsafeHostPairedModeEnabled(envOverrides);
 
   // ── Host process mode (owner) ───────────────────────────────────
   const startTime = Date.now();

src/message-agent-executor-target.ts

@@ -1,6 +1,8 @@
 import fs from 'fs';
 import path from 'path';
 
+import { isUnsafeHostPairedModeEnabled } from 'ejclaw-runners-shared';
+
 import { listAvailableGroups } from './available-groups.js';
 import {
   ARBITER_AGENT_TYPE,
@@ -115,8 +117,7 @@ export async function prepareMessageAgentExecutionTarget(
       ? { ...group, agentType: effectiveAgentType }
       : group;
   const isClaudeCodeAgent = effectiveAgentType === 'claude-code';
-  const unsafeHostPairedMode =
-    process.env.EJCLAW_UNSAFE_HOST_PAIRED_MODE === '1';
+  const unsafeHostPairedMode = isUnsafeHostPairedModeEnabled();
   const forceFreshClaudeReviewerSession =
     reviewerMode && isClaudeCodeAgent && unsafeHostPairedMode;
   const shouldPersistSession =

src/paired-execution-context.ts

@@ -2,7 +2,10 @@ import crypto from 'crypto';
 import fs from 'fs';
 import path from 'path';
 
-import { buildPairedReadonlyRuntimeEnvOverrides } from 'ejclaw-runners-shared';
+import {
+  buildPairedReadonlyRuntimeEnvOverrides,
+  isUnsafeHostPairedModeEnabled,
+} from 'ejclaw-runners-shared';
 
 import {
   ARBITER_DEADLOCK_THRESHOLD,
@@ -322,8 +325,7 @@ export function preparePairedExecutionContext(args: {
     EJCLAW_PAIRED_TASK_ID: task.id,
     EJCLAW_PAIRED_ROLE: roomRoleContext.role,
   };
-  const unsafeHostPairedMode =
-    process.env.EJCLAW_UNSAFE_HOST_PAIRED_MODE === '1';
+  const unsafeHostPairedMode = isUnsafeHostPairedModeEnabled();
 
   if (workspace?.workspace_dir) {
     envOverrides.EJCLAW_WORK_DIR = workspace.workspace_dir;