@brutalsystems/muster 3.1.0 → 3.1.1

package/dist/identity/claude.js

@@ -1,10 +1,11 @@
 /** Registry-reading mechanics vendored from Tin Can src/claude/discover.ts at
  * fbaaea5842fd4a5c86849d7f51c8e16b8683b058 (MIT). Only captured descendants are
  * read, rather than scanning and diffing live sessions. */
-import { readFile, access } from "node:fs/promises";
-import { join } from "node:path";
+import { readFile, access, realpath } from "node:fs/promises";
+import { dirname, join } from "node:path";
 import { homedir } from "node:os";
-import { descendants } from "./processes.js";
+import { command, descendants } from "./processes.js";
+import { workspaceTrustKey } from "./workspace-key.js";
 /**
  * Where Claude Code records its sessions. `CLAUDE_CONFIG_DIR` relocates the whole
  * configuration directory, sessions included, so discovery must follow it —
@@ -15,10 +16,11 @@ import { descendants } from "./processes.js";
 export function claudeSessionsDir(env) {
     return join(claudeConfigDir(env), "sessions");
 }
-/** The configuration directory itself, which `claudeSessionsDir` and the
- * workspace-trust read below both hang off. Split out so the two cannot drift:
- * a trust decision read from a different directory than the one the launch
- * records its session in would describe a profile nobody is launching. */
+/** The configuration directory itself, which `claudeSessionsDir` and
+ * `claudeTrustFile` both follow. Resolved from the same CLAUDE_CONFIG_DIR so
+ * the two cannot drift: a trust decision read from a different profile than
+ * the one the launch records its session in would describe a profile nobody
+ * is launching. */
 export function claudeConfigDir(env) {
     const configured = env.CLAUDE_CONFIG_DIR;
     if (typeof configured === "string" && configured.length)
@@ -26,10 +28,49 @@ export function claudeConfigDir(env) {
     return join(env.HOME ?? homedir(), ".claude");
 }
 /**
- * Whether Claude Code has recorded an accepted workspace-trust dialog for one
- * directory, in the profile a launch would use. Trust is per-directory and is
- * NOT inherited from a parent: a trusted `/Source/arm` says nothing about
- * `/Source/arm/centrumx`, and the child still stops at the dialog.
+ * The file Claude Code keeps workspace trust in. Not inside the configuration
+ * directory by default: with no CLAUDE_CONFIG_DIR it is `~/.claude.json`,
+ * beside `~/.claude`, and only a relocated profile keeps it inside.
+ */
+export function claudeTrustFile(env) {
+    const configured = env.CLAUDE_CONFIG_DIR;
+    return typeof configured === "string" && configured.length
+        ? join(configured, ".claude.json")
+        : join(env.HOME ?? homedir(), ".claude.json");
+}
+/**
+ * Every key whose accepted dialog lets a launch in `cwd` past Claude's trust
+ * dialog. The dialog gate walks up from the launch directory and stops at the
+ * git repo's top level, or walks to `/` outside a repository — so a trusted
+ * parent counts inside its own repo and never across a repo boundary. The
+ * repo's own trust key (the main checkout, for a linked worktree) is what
+ * Muster writes, so it counts too. See `workspaceTrustKey`.
+ */
+async function trustKeys(cwd) {
+    const resolved = await realpath(cwd).catch(() => cwd);
+    let top;
+    try {
+        const shown = (await command("git", ["-C", resolved, "rev-parse", "--show-toplevel"], 2000)).trim();
+        if (shown)
+            top = await realpath(shown).catch(() => shown);
+    }
+    catch { }
+    const keys = new Set([cwd]);
+    for (let dir = resolved;; dir = dirname(dir)) {
+        keys.add(dir);
+        if (dir === top || dirname(dir) === dir)
+            break;
+    }
+    keys.add(await workspaceTrustKey(resolved));
+    return [...keys];
+}
+/**
+ * Whether Claude Code would let a session in `cwd` past its workspace-trust
+ * dialog, in the profile a launch would use: an accepted dialog on the
+ * directory, on an ancestor inside the same git repo, or on the repo's trust
+ * key. Checking the exact directory alone called every worktree and every
+ * subdirectory of a trusted repo untrusted, and blamed trust for a launch that
+ * had simply timed out (#68).
  *
  * This only ever READS. Muster does not accept the dialog on the operator's
  * behalf — `setWorkspaceTrust` writes that flag into an identity copy Muster
@@ -44,18 +85,20 @@ export function claudeConfigDir(env) {
 export async function claudeWorkspaceTrusted(env, cwd) {
     let raw;
     try {
-        raw = await readFile(join(claudeConfigDir(env), ".claude.json"), "utf8");
+        raw = await readFile(claudeTrustFile(env), "utf8");
     }
     catch {
         return false;
     }
+    let projects;
     try {
-        const data = JSON.parse(raw);
-        return data.projects?.[cwd]?.hasTrustDialogAccepted === true;
+        projects =
+            JSON.parse(raw).projects ?? {};
     }
     catch {
         return false;
     }
+    return (await trustKeys(cwd)).some((key) => projects[key]?.hasTrustDialogAccepted === true);
 }
 /**
  * The message a Claude launch dies with when no session ever registered.
@@ -74,12 +117,12 @@ export async function claudeWorkspaceTrusted(env, cwd) {
  * it runs headless and never sees the dialog, so it succeeds where a session
  * hangs.
  */
-export function claudeRegistryDiagnostic(trusted, cwd, configDir, opts = {}) {
+export function claudeRegistryDiagnostic(trusted, cwd, trustFile, opts = {}) {
     if (!trusted)
         return (`no Claude session registry found: workspace trust has not been ` +
-            `accepted for ${cwd} in ${configDir} — accept it once with ` +
-            `\`cd ${cwd} && claude\`, then retry (trust is per-directory and is ` +
-            `not inherited from a parent directory)`);
+            `accepted for ${cwd} in ${trustFile} — accept it once with ` +
+            `\`cd ${cwd} && claude\`, then retry (a trusted parent directory ` +
+            `counts only inside the same git repository)`);
     if (opts.bypassWarningPending)
         return (`no Claude session registry found (${cwd} is trusted for this profile): ` +
             `this launch runs in bypass permissions, and Claude stops on its ` +

package/dist/identity-copy.js

@@ -1,4 +1,4 @@
-import { copyFile, mkdir, readFile, writeFile } from "node:fs/promises";
+import { appendFile, copyFile, mkdir, readFile, writeFile, } from "node:fs/promises";
 import { dirname, join } from "node:path";
 import TOML from "@iarna/toml";
 import { identityPath } from "./identity-store.js";
@@ -127,6 +127,15 @@ export async function setWorkspaceTrust(copyPath, cwd) {
     data.projects = projects;
     await writeFile(file, JSON.stringify(data), { mode: 0o600 });
 }
+function parses(text) {
+    try {
+        TOML.parse(text);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * Set Codex's directory-trust flag for one directory, inside a copy Muster just
  * created. Codex has its own gate, unrelated to Claude's: without a
@@ -145,8 +154,10 @@ export async function setWorkspaceTrust(copyPath, cwd) {
  * parses and is accepted, and the prompt still appears: the check reads
  * persisted config, so the entry has to be in the file.
  *
- * The user's real `~/.codex/config.toml` is never touched, for the same reason
- * `setWorkspaceTrust` leaves the live `~/.claude.json` alone.
+ * Also called on the user's own `~/.codex/config.toml`, for an
+ * `--options auto-approve-path` launch with no CODEX_HOME — the file that
+ * launch's Codex reads. That is why a new entry is appended rather than the
+ * file re-serialised.
  */
 export async function setCodexWorkspaceTrust(copyPath, cwd) {
     const file = join(copyPath, "config.toml");
@@ -177,6 +188,22 @@ export async function setCodexWorkspaceTrust(copyPath, cwd) {
     const existing = (projects[cwd] ?? {});
     if (existing.trust_level === "trusted")
         return;
+    // No entry yet: append one table, exactly as Codex itself does when you
+    // answer its dialog. This file may be the user's own `~/.codex/config.toml`
+    // (a launch with no CODEX_HOME), and re-serialising it would drop every
+    // comment and reorder every key in it. Not when the result would not parse
+    // — `projects` written as an inline table, under any quoting of its key,
+    // which a second `[projects.…]` header would redefine.
+    if (!(cwd in projects)) {
+        const lead = raw && !raw.endsWith("\n") ? "\n" : "";
+        const entry = `${lead}\n[projects.${JSON.stringify(cwd)}]\ntrust_level = "trusted"\n`;
+        if (parses((raw ?? "") + entry)) {
+            // ~/.codex itself may not exist on a machine that has never run Codex.
+            await mkdir(copyPath, { recursive: true, mode: 0o700 });
+            await appendFile(file, entry, { mode: 0o600 });
+            return;
+        }
+    }
     projects[cwd] = { ...existing, trust_level: "trusted" };
     data.projects = projects;
     // Re-serialised rather than appended, so an entry the template already

package/dist/on-exit.js

@@ -3,7 +3,8 @@
  * Kept out of run.ts so the environment contract can be tested without a
  * launch, since that contract is what every caller's script depends on.
  */
-import { mkdir, open, stat } from "node:fs/promises";
+import { constants } from "node:fs";
+import { access, mkdir, open, stat } from "node:fs/promises";
 import { dirname } from "node:path";
 import { spawn } from "node:child_process";
 /**
@@ -29,23 +30,44 @@ export function onExitEnv(entry, record) {
         MUSTER_RECORD: JSON.stringify(record),
     };
 }
+/**
+ * Why a directory cannot be a command's cwd, or undefined when it can: it must
+ * be a directory and searchable, because a spawn into one that is not fails
+ * after the claim is spent. Still a check, not a lock — the directory can
+ * change between here and the spawn, and that race is left to the spawn's own
+ * error, which the result records.
+ */
+async function enterable(dir) {
+    try {
+        if (!(await stat(dir)).isDirectory())
+            return "not a directory";
+        await access(dir, constants.X_OK);
+        return undefined;
+    }
+    catch (e) {
+        return e.message;
+    }
+}
 /**
  * Where the command will run and where its output will go, settled before the
  * command is claimed, because a claim is spent whether or not it then starts.
  * Neither failure is allowed to cost the signal: a directory removed since the
- * launch falls back to `fallbackCwd`, and a log that cannot be opened leaves
- * the output discarded. Each fallback is reported, for the launch log.
+ * launch, or one that can no longer be entered, falls back to `fallbackCwd`
+ * (and that to `/`), and a log that cannot be opened leaves the output
+ * discarded. Each fallback is reported, for the launch log.
  */
 export async function prepareOnExit(opts) {
     const warnings = [];
     let cwd = opts.cwd;
-    try {
-        if (!(await stat(cwd)).isDirectory())
-            throw new Error("not a directory");
-    }
-    catch (e) {
-        warnings.push(`cwd ${cwd} unusable (${e.message}); ran in ${opts.fallbackCwd}`);
+    const unusable = await enterable(cwd);
+    if (unusable) {
+        warnings.push(`cwd ${cwd} unusable (${unusable}); ran in ${opts.fallbackCwd}`);
         cwd = opts.fallbackCwd;
+        const fallback = await enterable(cwd);
+        if (fallback) {
+            warnings.push(`fallback ${cwd} unusable (${fallback}); ran in /`);
+            cwd = "/";
+        }
     }
     try {
         await mkdir(dirname(opts.logPath), { recursive: true, mode: 0o700 });

package/dist/run.js

@@ -19,7 +19,7 @@ import { assertOptionsSupported, screenWorkspace } from "./options.js";
 import { workspaceTrustKey } from "./identity/workspace-key.js";
 import { processRef, isSame, stopTree, delay, descendants, ownedGroup, groupAlive, } from "./identity/processes.js";
 import { resolveCodex } from "./identity/codex.js";
-import { claudeConfigDir, claudeRegistryDiagnostic, claudeWorkspaceTrusted, resolveClaude, } from "./identity/claude.js";
+import { claudeTrustFile, claudeRegistryDiagnostic, claudeWorkspaceTrusted, resolveClaude, } from "./identity/claude.js";
 import { openCodeEndpointOwnedBy, resolveOpenCode, } from "./identity/opencode.js";
 import { codexReachable, threadRejection } from "./reach/codex.js";
 import { claudeReachable } from "./reach/claude.js";
@@ -133,6 +133,20 @@ export function failedLaunchId(e) {
         ? e[FAILED_LAUNCH]
         : undefined;
 }
+/**
+ * Where an agent keeps its trust records when no configuration home is named,
+ * from the HOME it is spawned with. Codex only: its default `config.toml` is
+ * written by Codex just when you change a setting, and its trust entry is
+ * appended without rewriting the file. Claude's default is `~/.claude.json`,
+ * which every running session rewrites continuously, and a read-modify-write
+ * there could undo theirs — so a Claude launch with no CLAUDE_CONFIG_DIR still
+ * writes nothing, as before.
+ */
+function defaultConfigHome(runtime, env) {
+    return runtime === "codex"
+        ? join(env.HOME ?? homedir(), ".codex")
+        : undefined;
+}
 function configHomeVar(runtime) {
     return AGENTS[runtime].configHomeVar ?? undefined;
 }
@@ -550,8 +564,17 @@ export class Muster {
         // Written before the agent starts and into the SAME dir the child will open.
         // An identity launch has already had its copy trusted above, so this is a
         // no-op there rather than a second write.
-        if (req.options.includes("auto-approve-path") && configHome)
-            await AGENTS[req.runtime].trustWorkspace?.(configHome, await workspaceTrustKey(req.cwd));
+        //
+        // With no configuration home named, the agent reads its default one, and
+        // that is where the record has to go. Skipping it — as this did — made the
+        // option a silent no-op for every Codex launch without CODEX_HOME: the
+        // launch then sat on Codex's trust dialog and timed out with "no
+        // descendant runtime identity found".
+        if (req.options.includes("auto-approve-path")) {
+            const trustHome = configHome ?? defaultConfigHome(req.runtime, runtimeEnv);
+            if (trustHome)
+                await AGENTS[req.runtime].trustWorkspace?.(trustHome, await workspaceTrustKey(req.cwd));
+        }
         const resolveEnv = this.resolutionEnv(req.runtime, configHome);
         let bridgePath;
         if (req.runtime === "claude" && prepared.servers.length) {
@@ -874,7 +897,7 @@ export class Muster {
         // runs headless and never sees the dialog, so refusing an untrusted
         // directory up front would break task launches that work today.
         if (req.runtime === "claude" && diagnostic === neverRegistered)
-            diagnostic = claudeRegistryDiagnostic(await claudeWorkspaceTrusted(resolveEnv, req.cwd), req.cwd, claudeConfigDir(resolveEnv), {
+            diagnostic = claudeRegistryDiagnostic(await claudeWorkspaceTrusted(resolveEnv, req.cwd), req.cwd, claudeTrustFile(resolveEnv), {
                 bypassWarningPending: req.kind === "session" &&
                     permissions.permissions === "bypass" &&
                     !req.options.includes("accept-bypass-warning"),
@@ -1013,6 +1036,12 @@ export class Muster {
                 .catch(() => { });
             throw e;
         }
+        finally {
+            // The readiness connection is a `codex app-server` child of THIS
+            // process. Left open, its pipes keep the event loop alive, and the CLI
+            // that launched a Codex session never exits after printing the record.
+            await rpc?.close();
+        }
     }
     /**
      * The answer to a request we have already seen. Never a new launch: a repeat

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brutalsystems/muster",
-  "version": "3.1.0",
+  "version": "3.1.1",
   "description": "Launch instructed, reachable local agent sessions",
   "type": "module",
   "engines": {