feat(agentd): introduce AgentdConfig to read env vars once at startup

crates/agentd/bin/main.rs

@@ -18,9 +18,18 @@ fn main() {
     // Capture CLOCK_BOOTTIME immediately — this represents kernel boot duration.
     let boot_time_ns = microsandbox_agentd::clock::boottime_ns();
 
+    // Read all MSB_* environment variables once at startup and parse.
+    let config = match microsandbox_agentd::AgentdConfig::from_env() {
+        Ok(c) => c,
+        Err(e) => {
+            eprintln!("agentd: config parse failed: {e}");
+            std::process::exit(1);
+        }
+    };
+
     // Phase 1: Synchronous init (mount filesystems, prepare runtime directories).
     let init_start = microsandbox_agentd::clock::boottime_ns();
-    if let Err(e) = microsandbox_agentd::init::init() {
+    if let Err(e) = microsandbox_agentd::init::init(&config) {
         eprintln!("agentd: init failed: {e}");
         std::process::exit(1);
     }
@@ -33,7 +42,7 @@ fn main() {
         .expect("agentd: failed to build tokio runtime");
 
     rt.block_on(async {
-        match microsandbox_agentd::agent::run(boot_time_ns, init_time_ns).await {
+        match microsandbox_agentd::agent::run(boot_time_ns, init_time_ns, &config).await {
             Ok(()) => {}
             Err(microsandbox_agentd::AgentdError::Shutdown) => {}
             Err(e) => {

crates/agentd/lib/agent.rs

@@ -21,6 +21,7 @@ use microsandbox_protocol::{
 };
 
 use crate::{
+    config::AgentdConfig,
     error::{AgentdError, AgentdResult},
     fs::FsWriteSession,
     heartbeat::{heartbeat_dir_exists, write_heartbeat},
@@ -55,7 +56,7 @@ const MAX_INPUT_BUF_SIZE: usize = MAX_FRAME_SIZE as usize + 4;
 ///
 /// - `boot_time_ns`: `CLOCK_BOOTTIME` at `main()` start (kernel boot duration).
 /// - `init_time_ns`: nanoseconds spent in `init::init()`.
-pub async fn run(boot_time_ns: u64, init_time_ns: u64) -> AgentdResult<()> {
+pub async fn run(boot_time_ns: u64, init_time_ns: u64, config: &AgentdConfig) -> AgentdResult<()> {
     // Discover serial port.
     let port_path = find_serial_port(AGENT_PORT_NAME)?;
 
@@ -140,6 +141,7 @@ pub async fn run(boot_time_ns: u64, init_time_ns: u64) -> AgentdResult<()> {
                                     &mut write_sessions,
                                     &session_tx,
                                     &mut serial_out_buf,
+                                    config,
                                 ).await?;
                             }
 
@@ -214,14 +216,15 @@ async fn handle_message(
     write_sessions: &mut HashMap<u32, FsWriteSession>,
     session_tx: &mpsc::UnboundedSender<(u32, SessionOutput)>,
     out_buf: &mut Vec<u8>,
+    config: &AgentdConfig,
 ) -> AgentdResult<()> {
     match msg.t {
         MessageType::ExecRequest => {
             let mut req: ExecRequest = msg
                 .payload()
                 .map_err(|e| AgentdError::ExecSession(format!("decode exec request: {e}")))?;
             prepend_scripts_to_path(&mut req);
-            match ExecSession::spawn(msg.id, &req, session_tx.clone()) {
+            match ExecSession::spawn(msg.id, &req, session_tx.clone(), config.user.as_deref()) {
                 Ok(session) => {
                     let reply = Message::with_payload(
                         MessageType::ExecStarted,