@alanbem/dclaude 0.0.11 → 0.0.13

package/README.md

@@ -151,6 +151,21 @@ dclaude chrome                    # Launch Chrome with DevTools
 dclaude                           # Claude can now interact with the browser
 ```
 
+### iTerm2 Shell Integration
+
+If you use iTerm2 on macOS, dclaude automatically enables [iTerm2 Shell Integration](https://iterm2.com/documentation-shell-integration.html):
+
+- **Click URLs in output** - Opens in your Mac's browser
+- **imgcat** - Display images inline in terminal
+- **it2copy** - Copy to Mac clipboard from inside container
+- **Marks** - Navigate between command prompts
+
+This only activates when running in iTerm2. To disable:
+
+```bash
+DCLAUDE_ITERM2=false dclaude
+```
+
 ### System Context
 
 dclaude automatically tells Claude about its container environment so it can give better suggestions:
@@ -175,10 +190,12 @@ DCLAUDE_SYSTEM_CONTEXT=false dclaude
 | `DCLAUDE_NAMESPACE` | (none) | Namespace for isolated credentials/config |
 | `DCLAUDE_NETWORK` | `auto` | Network mode: `auto`, `host`, `bridge` |
 | `DCLAUDE_GIT_AUTH` | `auto` | SSH auth: `auto`, `agent-forwarding`, `key-mount`, `none` |
+| `DCLAUDE_MOUNT_ROOT` | (working dir) | Mount parent directory for sibling access |
 | `DCLAUDE_DEBUG` | `false` | Enable debug output |
 | `DCLAUDE_QUIET` | `false` | Suppress info messages |
 | `DCLAUDE_NO_UPDATE` | `false` | Skip image update check |
 | `DCLAUDE_SYSTEM_CONTEXT` | `true` | Inform Claude about container environment |
+| `DCLAUDE_ITERM2` | `true` | Enable iTerm2 shell integration (only affects iTerm2) |
 
 ## Configuration File
 
@@ -200,6 +217,7 @@ dclaude walks up the directory tree to find `.dclaude` files. Any dclaude sessio
 | `NAMESPACE` | Isolate credentials/config (see Namespace Isolation) |
 | `NETWORK` | Network mode (`host`, `bridge`) |
 | `GIT_AUTH` | Git auth mode |
+| `MOUNT_ROOT` | Mount directory (relative to config file, or absolute path) |
 | `DEBUG` | Enable debug output (`true`, `false`) |
 | `CHROME_PORT` | Chrome DevTools port |
 
@@ -238,6 +256,41 @@ Each namespace gets its own:
 - Git configuration
 - Container instance
 
+## Mount Root (Parent Directory Access)
+
+By default, dclaude only mounts the current working directory. Use `MOUNT_ROOT` to mount a parent directory, enabling access to sibling directories.
+
+**Use case:** You're working in a subdirectory but need access to related projects:
+
+```text
+/Users/alan/projects/mycompany/
+├── shared-libs/          # Common libraries
+├── api-service/          # API backend
+├── web-app/              # Frontend
+└── infrastructure/
+    └── terraform/        # ← You're here, but need access to siblings
+```
+
+**Option 1: Using `.dclaude` file (recommended)**
+```bash
+# Create config at the directory you want as mount root
+echo "MOUNT_ROOT=." > ~/projects/mycompany/.dclaude
+
+# Relative paths are resolved from config file's directory
+echo "MOUNT_ROOT=.." > ~/projects/mycompany/subdir/.dclaude  # mounts mycompany/
+```
+
+**Option 2: Using environment variable**
+```bash
+# Relative path (from working directory)
+DCLAUDE_MOUNT_ROOT=../.. dclaude
+
+# Absolute path
+DCLAUDE_MOUNT_ROOT=/Users/alan/projects/mycompany dclaude
+```
+
+Now Claude can see and work with all sibling directories while your working directory remains `terraform/`.
+
 ## Networking
 
 dclaude auto-detects the best networking mode:

package/dclaude

@@ -27,6 +27,7 @@ CHROME_FLAGS="${DCLAUDE_CHROME_FLAGS:-}"
 # - DCLAUDE_GIT_AUTH (git auth mode)
 # - DCLAUDE_DEBUG (enable debug output)
 # - DCLAUDE_CHROME_PORT (chrome devtools port)
+# - DCLAUDE_MOUNT_ROOT (mount a parent directory instead of working directory)
 
 # Colors for output (only if terminal supports it)
 if [[ -t 1 ]]; then
@@ -122,6 +123,18 @@ load_config_file() {
                 CHROME_PORT)
                     [[ -z "${DCLAUDE_CHROME_PORT:-}" ]] && DCLAUDE_CHROME_PORT="$value"
                     ;;
+                MOUNT_ROOT)
+                    if [[ -z "${DCLAUDE_MOUNT_ROOT:-}" ]]; then
+                        # Resolve relative paths relative to config file's directory
+                        if [[ "$value" != /* ]]; then
+                            local config_dir
+                            config_dir=$(dirname "$config_file")
+                            DCLAUDE_MOUNT_ROOT=$(cd "$config_dir" && cd "$value" 2>/dev/null && pwd)
+                        else
+                            DCLAUDE_MOUNT_ROOT="$value"
+                        fi
+                    fi
+                    ;;
             esac
         fi
     done < "$config_file"
@@ -147,6 +160,7 @@ if [[ -n "$DCLAUDE_CONFIG_FILE" ]]; then
         [[ -n "${DCLAUDE_NETWORK:-}" ]] && debug "  NETWORK=$DCLAUDE_NETWORK"
         [[ -n "${DCLAUDE_GIT_AUTH:-}" ]] && debug "  GIT_AUTH=$DCLAUDE_GIT_AUTH"
         [[ -n "${DCLAUDE_CHROME_PORT:-}" ]] && debug "  CHROME_PORT=$DCLAUDE_CHROME_PORT"
+        [[ -n "${DCLAUDE_MOUNT_ROOT:-}" ]] && debug "  MOUNT_ROOT=$DCLAUDE_MOUNT_ROOT"
     fi
 fi
 
@@ -577,6 +591,55 @@ get_host_path() {
     echo "$host_path"
 }
 
+# Compute mount root path from DCLAUDE_MOUNT_ROOT
+# Supports: absolute paths, relative paths (../, ../../, etc.)
+# Returns: Absolute path to mount root, or HOST_PATH if not set
+get_mount_root() {
+    local host_path="$1"
+    local mount_root="${DCLAUDE_MOUNT_ROOT:-}"
+
+    # If not set, use host path (current behavior)
+    if [[ -z "$mount_root" ]]; then
+        echo "$host_path"
+        return 0
+    fi
+
+    local resolved_root
+
+    # Handle relative paths (resolve relative to host_path)
+    if [[ "$mount_root" != /* ]]; then
+        # Relative path - resolve it
+        resolved_root=$(cd "$host_path" && cd "$mount_root" 2>/dev/null && pwd) || {
+            error "Mount root path not accessible: $mount_root (relative to $host_path)"
+            exit 1
+        }
+    else
+        # Absolute path - use directly
+        resolved_root="$mount_root"
+    fi
+
+    # Validate mount root exists
+    if [[ ! -d "$resolved_root" ]]; then
+        error "Mount root directory does not exist: $resolved_root"
+        exit 1
+    fi
+
+    # Validate that host_path is under mount_root
+    # Use realpath to normalize paths for comparison
+    local real_host real_root
+    real_host=$(cd "$host_path" && pwd -P)
+    real_root=$(cd "$resolved_root" && pwd -P)
+
+    if [[ "$real_host" != "$real_root" && "$real_host" != "$real_root"/* ]]; then
+        error "Working directory is not under mount root"
+        error "  Working directory: $real_host"
+        error "  Mount root: $real_root"
+        exit 1
+    fi
+
+    echo "$resolved_root"
+}
+
 # Generate deterministic container name from path (and namespace if set)
 get_container_name() {
     local path="${1:-$HOST_PATH}"
@@ -924,6 +987,423 @@ handle_git_auth() {
     fi
 }
 
+# ============================================================================
+# Agent Teams Tmux Passthrough — Relay Functions
+# ============================================================================
+# When the user runs dclaude from inside a host tmux session, these functions
+# set up a TCP relay that forwards Claude Code's tmux commands to the host.
+# This makes Agent Teams sub-agent panes visible in the host's tmux session.
+
+# Check if user is in a host tmux session
+detect_host_tmux() {
+    [[ -n "${TMUX:-}" ]]
+}
+
+# Check if host has required tools for relay (jq + socat or ncat)
+check_relay_deps() {
+    if ! command -v jq &>/dev/null; then
+        debug "Relay dep missing: jq"
+        return 1
+    fi
+    if command -v socat &>/dev/null; then
+        debug "Relay listener: socat"
+        return 0
+    fi
+    if command -v ncat &>/dev/null; then
+        debug "Relay listener: ncat"
+        return 0
+    fi
+    debug "Relay dep missing: socat or ncat"
+    return 1
+}
+
+# Get the address the container uses to reach the host relay
+get_relay_host() {
+    local platform="$1"
+    local network_mode="$2"
+    # Linux host mode: container shares host network, use loopback
+    if [[ "$platform" == "linux" && "$network_mode" == "host" ]]; then
+        echo "127.0.0.1"
+    else
+        # macOS (any mode) or Linux bridge: use Docker's host gateway
+        echo "host.docker.internal"
+    fi
+}
+
+# Get the address the relay binds to on the host
+get_relay_bind_addr() {
+    local platform="$1"
+    local network_mode="$2"
+    # Linux bridge: container reaches host via bridge gateway, not loopback
+    if [[ "$platform" == "linux" && "$network_mode" == "bridge" ]]; then
+        echo "0.0.0.0"
+    else
+        echo "127.0.0.1"
+    fi
+}
+
+# Get or create relay nonce for a container (reused across reattachments)
+get_or_create_relay_nonce() {
+    local container_name="$1"
+    local nonce_file="$HOME/.dclaude/tmux-relay-nonce-${container_name}"
+
+    mkdir -p "$HOME/.dclaude"
+
+    if [[ -f "$nonce_file" ]]; then
+        cat "$nonce_file"
+        return 0
+    fi
+
+    local nonce
+    nonce=$(head -c 32 /dev/urandom | base64 | tr -d '=/+' | head -c 32)
+    echo "$nonce" > "$nonce_file"
+    echo "$nonce"
+}
+
+# Generate the relay handler script (executed by socat/ncat for each connection)
+# Uses a non-quoted heredoc for baked-in values, then a single-quoted heredoc for logic
+generate_relay_handler() {
+    local container_name="$1"
+    local relay_port="$2"
+    local nonce="$3"
+    local handler_path="$4"
+    local tracking_file="$5"
+    local relay_host="$6"
+
+    # Header with baked-in values (variable expansion)
+    cat > "$handler_path" <<HANDLER_HEADER
+#!/bin/bash
+CONTAINER="$container_name"
+NONCE="$nonce"
+RELAY_PORT="$relay_port"
+RELAY_HOST="$relay_host"
+TRACKING_FILE="$tracking_file"
+HANDLER_HEADER
+
+    # Logic body (single-quoted heredoc — no escaping needed)
+    cat >> "$handler_path" <<'HANDLER_BODY'
+
+# Read one JSON line (max 65536 bytes to prevent memory exhaustion)
+read -r -n 65536 request
+if [[ -z "$request" ]]; then
+    printf '{"code":1,"stdout":"","stderr":"empty request"}\n'
+    exit 1
+fi
+
+# Validate nonce
+req_nonce=$(printf '%s' "$request" | jq -r '.nonce // empty')
+if [[ "$req_nonce" != "$NONCE" ]]; then
+    printf '{"code":1,"stdout":"","stderr":"authentication failed"}\n'
+    exit 1
+fi
+
+# Extract command array (bash 3.2 compatible — no mapfile)
+cmd=()
+while IFS= read -r line; do
+    cmd+=("$line")
+done < <(printf '%s' "$request" | jq -r '.cmd[]')
+subcmd="${cmd[0]}"
+cwd=$(printf '%s' "$request" | jq -r '.cwd // empty')
+req_pane=$(printf '%s' "$request" | jq -r '.pane // empty')
+
+# Allowlist tmux subcommands
+case "$subcmd" in
+    split-window|send-keys|list-panes|select-layout|resize-pane|\
+    select-pane|kill-pane|has-session|list-windows|display-message|list-sessions)
+        ;;
+    *)
+        printf '{"code":1,"stdout":"","stderr":"disallowed: %s"}\n' "$subcmd"
+        exit 1
+        ;;
+esac
+
+# Build tmux args based on subcommand
+args=()
+
+if [[ "$subcmd" == "split-window" ]]; then
+    args+=("split-window")
+
+    # Parse split-window flags, strip -c (handled by docker exec -w)
+    # and strip trailing shell command (replaced by docker exec)
+    i=1
+    while (( i < ${#cmd[@]} )); do
+        case "${cmd[$i]}" in
+            -b|-d|-f|-h|-I|-v|-P|-Z)
+                args+=("${cmd[$i]}")
+                ;;
+            -c)
+                # Capture directory, use for docker exec -w
+                (( i++ ))
+                cwd="${cmd[$i]}"
+                ;;
+            -e|-l|-t|-F)
+                # Flags with a value argument
+                args+=("${cmd[$i]}")
+                (( i++ ))
+                args+=("${cmd[$i]}")
+                ;;
+            -*)
+                # Unknown flag, pass through
+                args+=("${cmd[$i]}")
+                ;;
+            *)
+                # Shell command — skip (replaced by docker exec)
+                break
+                ;;
+        esac
+        (( i++ ))
+    done
+
+    # Validate cwd: absolute path, safe characters only
+    if [[ -n "$cwd" && ! "$cwd" =~ ^[a-zA-Z0-9/._-]+$ ]]; then
+        printf '{"code":1,"stdout":"","stderr":"invalid cwd"}\n'
+        exit 1
+    fi
+
+    # Append docker exec as the pane command (no sh -c, args as array)
+    args+=(
+        "--"
+        "docker" "exec" "-it"
+        "-e" "DCLAUDE_TMUX_RELAY_PORT=$RELAY_PORT"
+        "-e" "DCLAUDE_TMUX_RELAY_HOST=$RELAY_HOST"
+        "-e" "DCLAUDE_TMUX_RELAY_NONCE=$NONCE"
+        "-e" "DCLAUDE_CONTAINER=$CONTAINER"
+        "-u" "claude"
+        "-w" "${cwd:-/home/claude}"
+        "$CONTAINER"
+        "bash"
+    )
+
+elif [[ "$subcmd" == "send-keys" ]]; then
+    args+=("send-keys")
+
+    # Validate target pane is one we created
+    for (( i=1; i < ${#cmd[@]}; i++ )); do
+        if [[ "${cmd[$i]}" == "-t" && $(( i + 1 )) -lt ${#cmd[@]} ]]; then
+            target="${cmd[$(( i + 1 ))]}"
+            if [[ -f "$TRACKING_FILE" ]] && ! grep -qxF "$target" "$TRACKING_FILE"; then
+                printf '{"code":1,"stdout":"","stderr":"pane not tracked: %s"}\n' "$target"
+                exit 1
+            fi
+            break
+        fi
+    done
+
+    # Pass through all args
+    for (( i=1; i < ${#cmd[@]}; i++ )); do
+        args+=("${cmd[$i]}")
+    done
+
+elif [[ "$subcmd" == "kill-pane" ]]; then
+    args+=("kill-pane")
+    for (( i=1; i < ${#cmd[@]}; i++ )); do
+        args+=("${cmd[$i]}")
+    done
+else
+    # All other allowed commands: pass through args
+    # Inject -t $req_pane for commands that need pane context
+    # (relay runs outside tmux pane context, so tmux needs explicit targeting)
+    args+=("$subcmd")
+    has_target=false
+    for (( i=1; i < ${#cmd[@]}; i++ )); do
+        [[ "${cmd[$i]}" == "-t" ]] && has_target=true
+        [[ "${cmd[$i]}" =~ ^-t.+ ]] && has_target=true
+    done
+    # Only inject -t for commands that accept it (not list-sessions, has-session)
+    case "$subcmd" in
+        display-message|list-panes|list-windows|select-layout|resize-pane|select-pane)
+            if [[ "$has_target" == "false" && -n "$req_pane" ]]; then
+                args+=("-t" "$req_pane")
+            fi
+            ;;
+    esac
+    for (( i=1; i < ${#cmd[@]}; i++ )); do
+        args+=("${cmd[$i]}")
+    done
+fi
+
+# Execute tmux command, capture output
+stdout_file=$(mktemp)
+stderr_file=$(mktemp)
+tmux "${args[@]}" >"$stdout_file" 2>"$stderr_file"
+code=$?
+stdout=$(cat "$stdout_file")
+stderr=$(cat "$stderr_file")
+rm -f "$stdout_file" "$stderr_file"
+
+# Post-processing for split-window: track new pane ID
+if [[ "$subcmd" == "split-window" && $code -eq 0 ]]; then
+    pane_id=$(echo "$stdout" | head -1 | tr -d '[:space:]')
+    if [[ "$pane_id" =~ ^%[0-9]+$ ]]; then
+        echo "$pane_id" >> "$TRACKING_FILE"
+    fi
+fi
+
+# Post-processing for kill-pane: clean up orphaned processes after delay
+if [[ "$subcmd" == "kill-pane" && $code -eq 0 ]]; then
+    (
+        sleep 2
+        docker exec "$CONTAINER" bash -c '
+            ps -eo pid,ppid,tty,comm --no-headers 2>/dev/null | while read pid ppid tty comm; do
+                [[ "$ppid" == "0" && "$comm" == "bash" ]] || continue
+                [[ "$tty" =~ ^pts/([0-9]+)$ ]] || continue
+                (( ${BASH_REMATCH[1]} >= 2 )) || continue
+                children=$(ps --ppid "$pid" --no-headers 2>/dev/null | wc -l)
+                if [[ "$children" -eq 0 ]]; then
+                    kill -9 "$pid" 2>/dev/null
+                fi
+            done
+        '
+    ) &>/dev/null &
+fi
+
+# Return JSON response
+jq -nc --arg code "$code" --arg stdout "$stdout" --arg stderr "$stderr" \
+    '{code: ($code | tonumber), stdout: $stdout, stderr: $stderr}'
+HANDLER_BODY
+}
+
+# Start the relay listener on the host
+start_relay() {
+    local container_name="$1"
+    local relay_port="$2"
+    local nonce="$3"
+    local bind_addr="$4"
+    local relay_host="$5"
+
+    local handler_path="$HOME/.dclaude/tmux-relay-handler-${container_name}.sh"
+    local pid_file="$HOME/.dclaude/tmux-relay-pid-${container_name}"
+    local tracking_file="$HOME/.dclaude/tmux-relay-panes-${container_name}"
+
+    mkdir -p "$HOME/.dclaude"
+
+    # Generate handler script
+    generate_relay_handler "$container_name" "$relay_port" "$nonce" \
+        "$handler_path" "$tracking_file" "$relay_host"
+    chmod +x "$handler_path"
+
+    # Clear pane tracking
+    > "$tracking_file"
+
+    # Start listener
+    if command -v socat &>/dev/null; then
+        debug "Starting socat relay on $bind_addr:$relay_port"
+        socat "TCP-LISTEN:$relay_port,bind=$bind_addr,reuseaddr,fork,max-children=10" \
+            "EXEC:bash $handler_path" 2>/dev/null &
+    elif command -v ncat &>/dev/null; then
+        debug "Starting ncat relay on $bind_addr:$relay_port"
+        ncat -l -k "$bind_addr" "$relay_port" --sh-exec "$handler_path" &
+    else
+        error "No relay listener available (need socat or ncat)"
+        return 1
+    fi
+
+    echo $! > "$pid_file"
+    debug "Relay PID: $(cat "$pid_file")"
+}
+
+# Stop the relay and clean up
+stop_relay() {
+    local container_name="$1"
+
+    local pid_file="$HOME/.dclaude/tmux-relay-pid-${container_name}"
+    local handler_path="$HOME/.dclaude/tmux-relay-handler-${container_name}.sh"
+    local tracking_file="$HOME/.dclaude/tmux-relay-panes-${container_name}"
+
+    if [[ -f "$pid_file" ]]; then
+        local pid
+        pid=$(cat "$pid_file")
+        if [[ -n "$pid" ]]; then
+            # Kill forked handler processes first
+            pkill -P "$pid" 2>/dev/null || true
+            # Verify process identity before killing (guard against PID recycling)
+            local comm
+            comm=$(ps -p "$pid" -o comm= 2>/dev/null || true)
+            if [[ "$comm" =~ (socat|ncat) ]]; then
+                kill "$pid" 2>/dev/null || true
+            fi
+        fi
+    fi
+
+    # Clean up orphaned bash processes in container
+    cleanup_container_orphans "$container_name"
+
+    # Remove relay files (but keep nonce for reattachment)
+    rm -f "$pid_file" "$handler_path" "$tracking_file"
+}
+
+# Kill orphaned bash sessions in container (from dead docker exec panes)
+cleanup_container_orphans() {
+    local container_name="$1"
+
+    # Check container is running before trying
+    if ! docker ps -q -f name="^${container_name}$" 2>/dev/null | grep -q .; then
+        return 0
+    fi
+
+    docker exec "$container_name" bash -c '
+        ps -eo pid,ppid,tty,comm --no-headers 2>/dev/null | while read pid ppid tty comm; do
+            [[ "$ppid" == "0" && "$comm" == "bash" ]] || continue
+            [[ "$tty" =~ ^pts/([0-9]+)$ ]] || continue
+            (( ${BASH_REMATCH[1]} >= 2 )) || continue
+            children=$(ps --ppid "$pid" --no-headers 2>/dev/null | wc -l)
+            if [[ "$children" -eq 0 ]]; then
+                kill -9 "$pid" 2>/dev/null
+            fi
+        done
+    ' 2>/dev/null || true
+}
+
+# Set up Agent Teams relay if conditions are met
+# Sets globals: RELAY_STARTED, TMUX_SESSION_ENV_ARGS
+setup_agent_teams_relay() {
+    local container_name="$1"
+    local relay_port="$2"
+    local platform="$3"
+    local network_mode="$4"
+
+    RELAY_STARTED=false
+    TMUX_SESSION_ENV_ARGS=()
+
+    if [[ -z "$relay_port" ]]; then
+        debug "No relay port configured for this container"
+        TMUX_SESSION_ENV_ARGS=(-e "DCLAUDE_HIDE_TMUX=1")
+        return
+    fi
+
+    if ! detect_host_tmux; then
+        debug "Not in host tmux - Agent Teams will use in-process mode"
+        TMUX_SESSION_ENV_ARGS=(-e "DCLAUDE_HIDE_TMUX=1")
+        return
+    fi
+
+    if ! check_relay_deps; then
+        info "Tip: Install jq + socat (or ncat) for Agent Teams pane mode in tmux"
+        TMUX_SESSION_ENV_ARGS=(-e "DCLAUDE_HIDE_TMUX=1")
+        return
+    fi
+
+    local bind_addr relay_host relay_nonce host_pane
+    bind_addr=$(get_relay_bind_addr "$platform" "$network_mode")
+    relay_host=$(get_relay_host "$platform" "$network_mode")
+    relay_nonce=$(get_or_create_relay_nonce "$container_name")
+    host_pane=$(tmux display-message -p '#{pane_id}')
+
+    start_relay "$container_name" "$relay_port" "$relay_nonce" "$bind_addr" "$relay_host"
+    RELAY_STARTED=true
+
+    TMUX_SESSION_ENV_ARGS=(
+        -e "DCLAUDE_TMUX_RELAY_PORT=$relay_port"
+        -e "DCLAUDE_TMUX_RELAY_HOST=$relay_host"
+        -e "DCLAUDE_TMUX_RELAY_NONCE=$relay_nonce"
+        -e "DCLAUDE_HOST_PANE=$host_pane"
+        -e "DCLAUDE_CONTAINER=$container_name"
+    )
+
+    debug "Agent Teams relay: $bind_addr:$relay_port -> $container_name (pane $host_pane)"
+}
+# ============================================================================
+
 # Detect TTY availability and return appropriate Docker flags
 # Detect TTY status early (before any subshells)
 # Must be done at script top-level since $() subshells don't inherit TTY
@@ -968,6 +1448,17 @@ should_skip_tmux() {
     return 1
 }
 
+# Debug countdown before launching Claude (gives time to read debug output)
+# Press Enter to skip the countdown and launch immediately
+debug_countdown() {
+    if [[ "$DEBUG" == "true" ]]; then
+        for i in 5 4 3 2 1; do
+            printf '\r%b' "${CYAN}Debug: Launching in ${i}... (press Enter to skip)${NC}" >&2
+            read -t 1 -s 2>/dev/null && break
+        done
+        printf '\r%b\n' "${CYAN}Debug: Launching...                               ${NC}" >&2
+    fi
+}
 
 # Main execution
 main() {
@@ -976,6 +1467,9 @@ main() {
 
     info "Verifying environment..."
     debug "Host path: $HOST_PATH"
+    if [[ "$MOUNT_ROOT" != "$HOST_PATH" ]]; then
+        debug "Mount root: $MOUNT_ROOT"
+    fi
 
     # Check prerequisites
     check_docker
@@ -1108,6 +1602,9 @@ main() {
         debug "  SYSTEM_CONTEXT=$ENABLE_SYSTEM_CONTEXT"
         debug "  IMAGE=$IMAGE"
         debug "  HOST_PATH=$HOST_PATH"
+        if [[ "$MOUNT_ROOT" != "$HOST_PATH" ]]; then
+            debug "  MOUNT_ROOT=$MOUNT_ROOT"
+        fi
         debug "  PLATFORM=$platform"
     fi
 
@@ -1145,6 +1642,16 @@ main() {
                 done
             fi
 
+            # Ensure SSH proxy is running if container uses agent forwarding (macOS)
+            if [[ "$platform" == "darwin" ]]; then
+                local container_ssh_sock
+                container_ssh_sock=$(docker inspect --format='{{range .Config.Env}}{{println .}}{{end}}' "$container_name" 2>/dev/null | grep "^SSH_AUTH_SOCK=" | cut -d= -f2)
+                if [[ "$container_ssh_sock" == "/tmp/ssh-proxy/agent" ]]; then
+                    debug "Container uses SSH agent forwarding, ensuring proxy is running"
+                    setup_ssh_proxy_container
+                fi
+            fi
+
             # Check if interactive (TTY available) and not in print mode
             if [[ -n "$tty_flags" ]] && ! should_skip_tmux "${claude_args[@]}" "$@"; then
                 # Interactive and not print mode - use tmux for session management
@@ -1163,11 +1670,25 @@ main() {
                 [[ -n "${TERM_PROGRAM_VERSION:-}" ]] && exec_env_args+=(-e "TERM_PROGRAM_VERSION=${TERM_PROGRAM_VERSION}")
                 [[ -n "${TERM_SESSION_ID:-}" ]] && exec_env_args+=(-e "TERM_SESSION_ID=${TERM_SESSION_ID}")
                 [[ -n "${COLORTERM:-}" ]] && exec_env_args+=(-e "COLORTERM=${COLORTERM}")
+                [[ -n "${DCLAUDE_ITERM2:-}" ]] && exec_env_args+=(-e "DCLAUDE_ITERM2=${DCLAUDE_ITERM2}")
+
+                # Set up Agent Teams relay (or hide $TMUX for in-process mode)
+                local relay_port
+                relay_port=$(docker inspect --format='{{index .Config.Labels "dclaude.relay.port"}}' "$container_name" 2>/dev/null || true)
+                setup_agent_teams_relay "$container_name" "$relay_port" "$platform" "$network_mode"
+                if [[ "$RELAY_STARTED" == "true" ]]; then
+                    trap "stop_relay '$container_name'" EXIT
+                fi
 
                 debug "Creating new tmux session running Claude"
                 debug "Claude args count: ${#claude_args[@]}, user args: $*"
                 info "Starting new Claude session..."
-                docker exec -it -u claude "${exec_env_args[@]}" "$container_name" tmux -f /home/claude/.tmux.conf new-session -s "$tmux_session" claude "${claude_args[@]}" "$@"
+                debug_countdown
+                docker exec -it -u claude "${exec_env_args[@]}" "$container_name" \
+                    /usr/bin/tmux -L dclaude-inner -f /home/claude/.tmux.conf \
+                    new-session -s "$tmux_session" \
+                    "${TMUX_SESSION_ENV_ARGS[@]}" \
+                    claude-launcher.sh "${claude_args[@]}" "$@"
                 exit $?
             else
                 # Non-interactive or print mode - run claude directly without tmux
@@ -1200,11 +1721,11 @@ main() {
     claude_volume=$(get_volume_name)
 
     DOCKER_ARGS+=(
-        # Mount current directory
-        -v "${HOST_PATH}:${HOST_PATH}"
+        # Mount directory tree (mount root allows access to parent directories)
+        -v "${MOUNT_ROOT}:${MOUNT_ROOT}"
         # Mount persistent Claude configuration volume
         -v "${claude_volume}:/home/claude/.claude"
-        # Set working directory
+        # Set working directory (within the mounted tree)
         -w "${HOST_PATH}"
         # Network mode
         --network="$network_mode"
@@ -1218,6 +1739,17 @@ main() {
     debug "SSH port reserved: $ssh_port"
     DOCKER_ARGS+=(--label "dclaude.ssh.port=${ssh_port}")
 
+    # Reserve relay port for Agent Teams tmux passthrough
+    local relay_port
+    relay_port=$(find_available_port 30000 60000)
+    debug "Relay port reserved: $relay_port"
+    DOCKER_ARGS+=(--label "dclaude.relay.port=${relay_port}")
+
+    # Add host.docker.internal for Linux bridge mode (needed for relay connectivity)
+    if [[ "$platform" == "linux" && "$network_mode" == "bridge" ]]; then
+        DOCKER_ARGS+=(--add-host "host.docker.internal:host-gateway")
+    fi
+
     # Port mapping only needed for bridge mode (host mode shares network stack)
     if [[ "$network_mode" != "host" ]]; then
         DOCKER_ARGS+=(-p "${ssh_port}:${ssh_port}")
@@ -1240,6 +1772,11 @@ main() {
         DOCKER_ARGS+=(-e "COLORTERM=${COLORTERM}")
     fi
 
+    # Pass through iTerm2 integration opt-out if set
+    if [[ -n "${DCLAUDE_ITERM2:-}" ]]; then
+        DOCKER_ARGS+=(-e "DCLAUDE_ITERM2=${DCLAUDE_ITERM2}")
+    fi
+
     # Mount Docker socket if detected (detection done earlier for system context)
     if [[ -n "$DOCKER_SOCKET" ]] && [[ -S "$DOCKER_SOCKET" ]]; then
         DOCKER_ARGS+=(-v "${DOCKER_SOCKET}:/var/run/docker.sock")
@@ -1310,11 +1847,23 @@ main() {
             [[ -n "${TERM_PROGRAM_VERSION:-}" ]] && exec_env_args+=(-e "TERM_PROGRAM_VERSION=${TERM_PROGRAM_VERSION}")
             [[ -n "${TERM_SESSION_ID:-}" ]] && exec_env_args+=(-e "TERM_SESSION_ID=${TERM_SESSION_ID}")
             [[ -n "${COLORTERM:-}" ]] && exec_env_args+=(-e "COLORTERM=${COLORTERM}")
+            [[ -n "${DCLAUDE_ITERM2:-}" ]] && exec_env_args+=(-e "DCLAUDE_ITERM2=${DCLAUDE_ITERM2}")
+
+            # Set up Agent Teams relay (or hide $TMUX for in-process mode)
+            setup_agent_teams_relay "$container_name" "$relay_port" "$platform" "$network_mode"
+            if [[ "$RELAY_STARTED" == "true" ]]; then
+                trap "stop_relay '$container_name'" EXIT
+            fi
 
             debug "Creating new tmux session running Claude"
             debug "Claude args count: ${#claude_args[@]}, user args: $*"
             info "Starting new Claude session..."
-            docker exec -it -u claude "${exec_env_args[@]}" "$container_name" tmux -f /home/claude/.tmux.conf new-session -s "$tmux_session" claude "${claude_args[@]}" "$@"
+            debug_countdown
+            docker exec -it -u claude "${exec_env_args[@]}" "$container_name" \
+                /usr/bin/tmux -L dclaude-inner -f /home/claude/.tmux.conf \
+                new-session -s "$tmux_session" \
+                "${TMUX_SESSION_ENV_ARGS[@]}" \
+                claude-launcher.sh "${claude_args[@]}" "$@"
             exit $?
         else
             # Non-interactive or print mode - run claude directly without tmux
@@ -1444,11 +1993,11 @@ cmd_attach() {
         fi
     fi
 
-    # Check if session exists
-    if ! docker exec -u claude "$container_name" tmux has-session -t "$session_name" 2>/dev/null; then
+    # Check if session exists (use -L dclaude-inner for namespaced socket)
+    if ! docker exec -u claude "$container_name" /usr/bin/tmux -L dclaude-inner has-session -t "$session_name" 2>/dev/null; then
         error "Session '$session_name' not found in container"
         info "Available sessions:"
-        docker exec -u claude "$container_name" tmux list-sessions 2>/dev/null || echo "  (no sessions running)"
+        docker exec -u claude "$container_name" /usr/bin/tmux -L dclaude-inner list-sessions 2>/dev/null || echo "  (no sessions running)"
         exit 1
     fi
 
@@ -1458,10 +2007,24 @@ cmd_attach() {
     [[ -n "${TERM_PROGRAM_VERSION:-}" ]] && exec_env_args+=(-e "TERM_PROGRAM_VERSION=${TERM_PROGRAM_VERSION}")
     [[ -n "${TERM_SESSION_ID:-}" ]] && exec_env_args+=(-e "TERM_SESSION_ID=${TERM_SESSION_ID}")
     [[ -n "${COLORTERM:-}" ]] && exec_env_args+=(-e "COLORTERM=${COLORTERM}")
+    [[ -n "${DCLAUDE_ITERM2:-}" ]] && exec_env_args+=(-e "DCLAUDE_ITERM2=${DCLAUDE_ITERM2}")
+
+    # Restart relay if the session uses it (relay was stopped when previous dclaude exited)
+    local relay_port
+    relay_port=$(docker inspect --format='{{index .Config.Labels "dclaude.relay.port"}}' "$container_name" 2>/dev/null || true)
+    local platform
+    platform=$(detect_platform)
+    local network_mode
+    network_mode=$(docker inspect --format='{{.HostConfig.NetworkMode}}' "$container_name" 2>/dev/null || echo "bridge")
+    setup_agent_teams_relay "$container_name" "$relay_port" "$platform" "$network_mode"
+    if [[ "$RELAY_STARTED" == "true" ]]; then
+        trap "stop_relay '$container_name'" EXIT
+    fi
 
     # Attach to existing session
     info "Attaching to session: $session_name"
-    docker exec -it -u claude "${exec_env_args[@]}" "$container_name" tmux -f /home/claude/.tmux.conf attach-session -t "$session_name"
+    docker exec -it -u claude "${exec_env_args[@]}" "$container_name" \
+        /usr/bin/tmux -L dclaude-inner -f /home/claude/.tmux.conf attach-session -t "$session_name"
     exit $?
 }
 
@@ -1514,7 +2077,7 @@ cmd_chrome() {
     fi
 
     # 2. Setup profile directory
-    local profile_dir="$HOST_PATH/.dclaude/chrome/profiles/$CHROME_PROFILE"
+    local profile_dir="$HOST_PATH/.dclaude.d/chrome/profiles/$CHROME_PROFILE"
     mkdir -p "$profile_dir"
     debug "Profile directory: $profile_dir"
 
@@ -1683,7 +2246,7 @@ cmd_stop() {
     if [[ "$container_status" == "running" ]]; then
         # Count active tmux sessions
         local session_count
-        session_count=$(docker exec -u claude "$container_name" tmux list-sessions 2>/dev/null | wc -l | tr -d '[:space:]') || session_count=0
+        session_count=$(docker exec -u claude "$container_name" /usr/bin/tmux -L dclaude-inner list-sessions 2>/dev/null | wc -l | tr -d '[:space:]') || session_count=0
 
         if [[ "$session_count" =~ ^[0-9]+$ ]] && [[ "$session_count" -gt 0 ]]; then
             info "Stopping container $container_name ($session_count active session(s))..."
@@ -1691,6 +2254,9 @@ cmd_stop() {
             info "Stopping container $container_name..."
         fi
 
+        # Stop relay if running
+        stop_relay "$container_name"
+
         if docker stop "$container_name" >/dev/null; then
             success "Container stopped"
         else
@@ -1869,7 +2435,7 @@ cmd_rm() {
         if [[ "$force" == "true" ]]; then
             # Count active tmux sessions
             local session_count
-            session_count=$(docker exec -u claude "$container_name" tmux list-sessions 2>/dev/null | wc -l | tr -d '[:space:]') || session_count=0
+            session_count=$(docker exec -u claude "$container_name" /usr/bin/tmux -L dclaude-inner list-sessions 2>/dev/null | wc -l | tr -d '[:space:]') || session_count=0
 
             if [[ "$session_count" =~ ^[0-9]+$ ]] && [[ "$session_count" -gt 0 ]]; then
                 info "Removing running container $container_name ($session_count active session(s))..."
@@ -1877,6 +2443,10 @@ cmd_rm() {
                 info "Removing running container $container_name..."
             fi
 
+            # Clean up relay (including nonce file since container is being removed)
+            stop_relay "$container_name"
+            rm -f "$HOME/.dclaude/tmux-relay-nonce-${container_name}"
+
             if docker rm -f "$container_name" >/dev/null; then
                 success "Container removed"
             else
@@ -1891,6 +2461,11 @@ cmd_rm() {
         fi
     else
         info "Removing container $container_name..."
+
+        # Clean up relay files (including nonce since container is being removed)
+        stop_relay "$container_name"
+        rm -f "$HOME/.dclaude/tmux-relay-nonce-${container_name}"
+
         if docker rm "$container_name" >/dev/null; then
             success "Container removed"
         else
@@ -1989,8 +2564,9 @@ cmd_git() {
     exit 0
 }
 
-# Initialize HOST_PATH once for all commands
+# Initialize HOST_PATH and MOUNT_ROOT once for all commands
 HOST_PATH=$(get_host_path)
+MOUNT_ROOT=$(get_mount_root "$HOST_PATH")
 
 # Handle subcommands
 if [[ $# -gt 0 ]]; then
@@ -2067,6 +2643,7 @@ Environment Variables:
   DCLAUDE_NAMESPACE          Namespace for isolated credentials/config
   DCLAUDE_GIT_AUTH           SSH auth for Git: auto, agent-forwarding, key-mount, none
   DCLAUDE_NETWORK            Network mode: auto, host, bridge
+  DCLAUDE_MOUNT_ROOT         Mount parent directory (absolute or relative path)
   DCLAUDE_DOCKER_SOCKET      Override Docker socket path
   DCLAUDE_TMUX_SESSION       Custom tmux session name (default: claude-TIMESTAMP)
   DCLAUDE_CHROME_BIN         Chrome executable path (auto-detected if not set)
@@ -2079,6 +2656,8 @@ Configuration File (.dclaude):
     NAMESPACE=mycompany
     NETWORK=host
     DEBUG=true
+    MOUNT_ROOT=.           # Mount config file's directory
+    MOUNT_ROOT=..          # Mount parent of config file's directory
   dclaude walks up the directory tree to find .dclaude files.
   Environment variables override .dclaude settings.
 
@@ -2102,6 +2681,11 @@ Examples:
   DCLAUDE_NAMESPACE=mycompany dclaude
   # Or create .dclaude file: echo "NAMESPACE=mycompany" > ~/projects/mycompany/.dclaude
 
+  # Mount parent directory to access sibling directories
+  DCLAUDE_MOUNT_ROOT=.. dclaude                    # Relative path
+  DCLAUDE_MOUNT_ROOT=/Users/alan/projects dclaude  # Absolute path
+  # Or in .dclaude file: MOUNT_ROOT=..
+
   # Update image and restart container
   dclaude pull                                   # Pull latest image
   dclaude update                                 # Update Claude CLI in container

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alanbem/dclaude",
-  "version": "0.0.11",
+  "version": "0.0.13",
   "description": "Dockerized Claude Code CLI launcher with MCP support",
   "main": "dclaude",
   "bin": {