@fitlab-ai/agent-infra 0.7.7 → 0.8.1

package/lib/run/index.ts

@@ -0,0 +1,237 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { loadServerConfig } from '../server/config.ts';
+import { resolveTaskBranch } from '../sandbox/task-resolver.ts';
+import { createRunId, runInSandbox, type SandboxRunMetadata } from '../sandbox/capture.ts';
+import { loadShortIdByTaskId, normalizeShortIdInput } from '../task/short-id.ts';
+import { buildTuiCommand, renderPrompt, selectTui } from './tui.ts';
+import { getSkillRunSpec } from './skills.ts';
+import { runHostCommand, type RunProcessResult } from './host.ts';
+
+export type ParsedRunArgs = {
+  skill: string;
+  taskRef: string | null;
+  args: string[];
+  tui: string | null;
+};
+
+export type SandboxRunRequest = {
+  taskRef: string;
+  branch: string;
+  command: string[];
+  runId?: string;
+};
+
+export type SandboxRunResult = RunProcessResult & {
+  run?: SandboxRunMetadata;
+};
+
+export type RunSkillOptions = {
+  command?: Record<string, unknown>;
+  repoRoot?: string;
+  runHost?: (command: string[]) => Promise<RunProcessResult>;
+  runSandbox?: (request: SandboxRunRequest) => Promise<SandboxRunResult>;
+  writeStdout?: (chunk: string) => void;
+  writeStderr?: (chunk: string) => void;
+};
+
+const USAGE = `Usage: ai run <skill> [task-ref] [args...] [--tui <name>]
+
+Task skills are scheduled inside the sandbox tmux session; ai run returns once
+the tmux window is created.
+
+Examples:
+  ai run create-task "describe the task" --tui codex
+  ai run code-task #7 --tui codex`;
+
+function extractTui(args: string[]): { rest: string[]; tui: string | null } {
+  const rest: string[] = [];
+  let tui: string | null = null;
+  for (let i = 0; i < args.length; i += 1) {
+    const arg = args[i] as string;
+    if (arg === '--tui') {
+      const value = args[i + 1];
+      if (!value) throw new Error('--tui requires a value');
+      tui = value;
+      i += 1;
+      continue;
+    }
+    rest.push(arg);
+  }
+  return { rest, tui };
+}
+
+export function parseRunArgs(args: string[]): ParsedRunArgs {
+  if (args.length === 0 || args[0] === '--help' || args[0] === '-h') {
+    throw new Error(USAGE);
+  }
+  const { rest, tui } = extractTui(args);
+  const [skill = '', maybeTaskRef, ...remaining] = rest;
+  const spec = getSkillRunSpec(skill);
+  if (!spec) throw new Error(`Unknown skill '${skill}'`);
+  if (spec.kind === 'create') {
+    const createArgs = rest.slice(1);
+    if (createArgs.length === 0) throw new Error('create-task requires a description');
+    return { skill, taskRef: null, args: createArgs, tui };
+  }
+  if (!maybeTaskRef) throw new Error(`${skill} requires a task-ref`);
+  return { skill, taskRef: maybeTaskRef, args: remaining, tui };
+}
+
+function assertAllowedByConfig(skill: string, commandConfig: Record<string, unknown>): void {
+  const allowed = commandConfig.allowedSkills;
+  if (!Array.isArray(allowed)) return;
+  if (!allowed.every((entry) => typeof entry === 'string')) {
+    throw new Error('command.allowedSkills must be an array of skill names');
+  }
+  if (!allowed.includes(skill)) {
+    throw new Error(`Skill '${skill}' is not allowed by command.allowedSkills`);
+  }
+}
+
+const TASK_ID_RE = /^TASK-\d{8}-\d{6}$/;
+
+function readShortIdLength(repoRoot: string): number {
+  try {
+    const cfg = JSON.parse(fs.readFileSync(path.join(repoRoot, '.agents', '.airc.json'), 'utf8'));
+    const value = cfg?.task?.shortIdLength;
+    if (typeof value === 'number' && Number.isFinite(value) && value >= 1) return value;
+  } catch {
+    // Use the project default when config is absent in lightweight tests.
+  }
+  return 2;
+}
+
+function readActiveShortIdRegistry(repoRoot: string): Record<string, string> {
+  const registryPath = path.join(repoRoot, '.agents', 'workspace', 'active', '.short-ids.json');
+  try {
+    const data = JSON.parse(fs.readFileSync(registryPath, 'utf8'));
+    return data && typeof data === 'object' && data.ids && typeof data.ids === 'object' ? data.ids : {};
+  } catch {
+    return {};
+  }
+}
+
+type ActiveTaskIdentity = {
+  taskId: string;
+  taskDir: string;
+  taskRef: string;
+};
+
+function resolveActiveTaskIdentity(taskRef: string, repoRoot: string): ActiveTaskIdentity | null {
+  let taskId: string | null = null;
+  let resolvedTaskRef = taskRef;
+
+  if (TASK_ID_RE.test(taskRef)) {
+    taskId = taskRef;
+    resolvedTaskRef = loadShortIdByTaskId(repoRoot).get(taskId) ?? taskRef;
+  } else {
+    const normalized = normalizeShortIdInput(taskRef, { shortIdLength: readShortIdLength(repoRoot) });
+    if (normalized.kind !== 'shortId') return null;
+    resolvedTaskRef = normalized.value;
+    taskId = readActiveShortIdRegistry(repoRoot)[normalized.value.slice(1)] ?? null;
+  }
+
+  if (!taskId) return null;
+  const taskDir = path.join(repoRoot, '.agents', 'workspace', 'active', taskId);
+  if (!fs.existsSync(path.join(taskDir, 'task.md'))) return null;
+  return { taskId, taskDir, taskRef: resolvedTaskRef };
+}
+
+function formatLocalTimestamp(date: Date = new Date()): string {
+  const pad = (n: number): string => String(n).padStart(2, '0');
+  const year = date.getFullYear();
+  const month = pad(date.getMonth() + 1);
+  const day = pad(date.getDate());
+  const hour = pad(date.getHours());
+  const minute = pad(date.getMinutes());
+  const second = pad(date.getSeconds());
+  const offsetMinutes = -date.getTimezoneOffset();
+  const sign = offsetMinutes >= 0 ? '+' : '-';
+  const offsetHour = pad(Math.floor(Math.abs(offsetMinutes) / 60));
+  const offsetMinute = pad(Math.abs(offsetMinutes) % 60);
+  return `${year}-${month}-${day} ${hour}:${minute}:${second}${sign}${offsetHour}:${offsetMinute}`;
+}
+
+function writeRunRecord(params: {
+  identity: ActiveTaskIdentity;
+  run: SandboxRunMetadata;
+  branch: string;
+  command: string[];
+}): void {
+  const runsDir = path.join(params.identity.taskDir, 'runs');
+  fs.mkdirSync(runsDir, { recursive: true });
+  const record = {
+    version: 1,
+    run_id: params.run.runId,
+    task_id: params.identity.taskId,
+    task_ref: params.identity.taskRef,
+    branch: params.branch,
+    engine: params.run.engine,
+    container: params.run.container,
+    run_dir: params.run.runDir,
+    status_file: `${params.run.runDir}/status`,
+    log_file: `${params.run.runDir}/output.log`,
+    created_at: formatLocalTimestamp(),
+    command: params.command
+  };
+  fs.writeFileSync(
+    path.join(runsDir, `${params.run.runId}.json`),
+    `${JSON.stringify(record, null, 2)}\n`,
+    'utf8'
+  );
+}
+
+export async function runSkill(args: string[], options: RunSkillOptions = {}): Promise<number> {
+  const parsed = parseRunArgs(args);
+  const config = options.command ? null : loadServerConfig({ rootDir: options.repoRoot });
+  const commandConfig = options.command ?? config?.command ?? {};
+  assertAllowedByConfig(parsed.skill, commandConfig);
+  const tui = selectTui(parsed.skill, { cliTui: parsed.tui, command: commandConfig });
+  const promptArgs = parsed.taskRef === null ? parsed.args : [parsed.taskRef, ...parsed.args];
+  const prompt = renderPrompt({ tui, skill: parsed.skill, args: promptArgs });
+  const [file, argv] = buildTuiCommand(tui, prompt);
+  const command = [file, ...argv];
+
+  if (parsed.taskRef === null) {
+    const result = await (options.runHost ?? runHostCommand)(command);
+    return result.exitCode ?? (result.signal ? 1 : 0);
+  }
+
+  const repoRoot = options.repoRoot ?? config?.repoRoot ?? process.cwd();
+  const branch = resolveTaskBranch(parsed.taskRef, repoRoot);
+  const identity = resolveActiveTaskIdentity(parsed.taskRef, repoRoot);
+  const runId = identity ? createRunId() : undefined;
+  const writeStdout = options.writeStdout ?? ((chunk: string) => process.stdout.write(chunk));
+  const writeStderr = options.writeStderr ?? ((chunk: string) => process.stderr.write(chunk));
+  const runSandbox =
+    options.runSandbox ??
+    ((request: SandboxRunRequest) => runInSandbox(request));
+  const result = await runSandbox({ taskRef: parsed.taskRef, branch, command, runId });
+  if (result.stdout) {
+    writeStdout(result.stdout);
+  }
+  if (result.stderr) {
+    writeStderr(result.stderr);
+  }
+  if ((result.exitCode ?? (result.signal ? 1 : 0)) === 0 && identity && result.run) {
+    writeRunRecord({ identity, run: result.run, branch, command });
+  }
+  return result.exitCode ?? (result.signal ? 1 : 0);
+}
+
+export async function cmdRun(args: string[]): Promise<void> {
+  try {
+    const code = await runSkill(args);
+    process.exitCode = code;
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (message.startsWith('Usage:')) {
+      process.stdout.write(`${message}\n`);
+      process.exitCode = args.length === 0 ? 1 : 0;
+    } else {
+      process.stderr.write(`Error: ${message}\n`);
+      process.exitCode = 1;
+    }
+  }
+}

package/lib/run/prompt.ts

@@ -0,0 +1 @@
+export { renderPrompt } from './tui.ts';

package/lib/run/skills.ts

@@ -0,0 +1,34 @@
+export type SkillRunSpec =
+  | { kind: 'task'; skill: string; role: 'exec'; requiresSandbox: true }
+  | { kind: 'create'; skill: 'create-task'; role: 'exec'; requiresSandbox: false };
+
+const TASK_SKILLS = new Set([
+  'analyze-task',
+  'block-task',
+  'cancel-task',
+  'code-task',
+  'commit',
+  'complete-task',
+  'create-pr',
+  'plan-task',
+  'review-analysis',
+  'review-code',
+  'review-plan',
+  'test',
+  'test-integration',
+  'watch-pr'
+]);
+
+export function getSkillRunSpec(skill: string): SkillRunSpec | null {
+  if (skill === 'create-task') {
+    return { kind: 'create', skill: 'create-task', role: 'exec', requiresSandbox: false };
+  }
+  if (TASK_SKILLS.has(skill)) {
+    return { kind: 'task', skill, role: 'exec', requiresSandbox: true };
+  }
+  return null;
+}
+
+export function allowedSkillNames(): string[] {
+  return ['create-task', ...TASK_SKILLS].sort();
+}

package/lib/run/tui.ts

@@ -0,0 +1,40 @@
+export type TuiName = 'claude' | 'codex' | 'gemini' | 'opencode';
+
+const TUI_NAMES = new Set(['claude', 'codex', 'gemini', 'opencode']);
+
+export type CommandConfig = {
+  defaultTui?: unknown;
+  skillTuiDefaults?: unknown;
+};
+
+function isTuiName(value: unknown): value is TuiName {
+  return typeof value === 'string' && TUI_NAMES.has(value);
+}
+
+export function selectTui(
+  skill: string,
+  options: { cliTui?: string | null; command?: CommandConfig }
+): TuiName {
+  if (isTuiName(options.cliTui)) return options.cliTui;
+  const defaults = options.command?.skillTuiDefaults;
+  if (defaults && typeof defaults === 'object' && !Array.isArray(defaults)) {
+    const value = (defaults as Record<string, unknown>)[skill];
+    if (isTuiName(value)) return value;
+  }
+  if (isTuiName(options.command?.defaultTui)) return options.command.defaultTui;
+  return 'codex';
+}
+
+export function renderPrompt(params: { tui: TuiName; skill: string; args: string[] }): string {
+  const suffix = [params.skill, ...params.args].join(' ').trim();
+  if (params.tui === 'codex') return `$${suffix}`;
+  if (params.tui === 'gemini') return `/agent-infra:${suffix}`;
+  return `/${suffix}`;
+}
+
+export function buildTuiCommand(tui: TuiName, prompt: string): [string, string[]] {
+  if (tui === 'claude') return ['claude', ['--dangerously-skip-permissions', '--print', prompt]];
+  if (tui === 'gemini') return ['gemini', ['--approval-mode', 'yolo', '--prompt', prompt]];
+  if (tui === 'opencode') return ['opencode', ['run', '--dangerously-skip-permissions', prompt]];
+  return ['codex', ['exec', '--dangerously-bypass-approvals-and-sandbox', prompt]];
+}

package/lib/sandbox/capture.ts

@@ -0,0 +1,215 @@
+import { spawn } from 'node:child_process';
+import { loadConfig } from './config.ts';
+import { containerNameCandidates, sandboxBranchLabel, sandboxLabel } from './constants.ts';
+import { detectEngine } from './engine.ts';
+import { hostTimezoneEnvFlags, terminalEnvFlags } from './commands/enter.ts';
+import {
+  fetchSandboxRows,
+  selectSandboxContainer,
+  startSandboxContainer,
+  type SandboxRow
+} from './commands/list-running.ts';
+
+export type SandboxCaptureRequest = {
+  taskRef: string;
+  branch: string;
+  command: string[];
+  timeoutMs?: number;
+};
+
+export type SandboxCaptureResult = {
+  exitCode: number | null;
+  signal: NodeJS.Signals | null;
+  stdout: string;
+  stderr: string;
+  run?: SandboxRunMetadata;
+};
+
+export type SandboxRunMetadata = {
+  runId: string;
+  engine: string;
+  container: string;
+  runDir: string;
+};
+
+export type SandboxCaptureOptions = {
+  engine?: string;
+  repoRoot?: string;
+  runId?: string;
+  containerCandidates?: string[];
+  rows?: SandboxRow[];
+  startContainer?: (name: string) => void;
+  spawn?: (file: string, args: string[]) => Promise<SandboxCaptureResult>;
+};
+
+async function spawnCapture(
+  file: string,
+  args: string[]
+): Promise<SandboxCaptureResult> {
+  return new Promise((resolve, reject) => {
+    const child = spawn(file, args, { stdio: ['ignore', 'pipe', 'pipe'] });
+    let stdout = '';
+    let stderr = '';
+    let settled = false;
+    const rejectOnce = (error: unknown): void => {
+      if (settled) return;
+      settled = true;
+      reject(error);
+    };
+    const resolveOnce = (result: SandboxCaptureResult): void => {
+      if (settled) return;
+      settled = true;
+      resolve(result);
+    };
+    child.stdout.setEncoding('utf8');
+    child.stderr.setEncoding('utf8');
+    child.stdout.on('data', (chunk) => {
+      stdout += chunk;
+    });
+    child.stderr.on('data', (chunk) => {
+      stderr += chunk;
+    });
+    child.on('error', rejectOnce);
+    child.on('close', (exitCode, signal) => {
+      resolveOnce({ exitCode, signal, stdout, stderr });
+    });
+  });
+}
+
+function shellQuote(value: string): string {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+
+export function createRunId(date: Date = new Date()): string {
+  return `run-${date.toISOString().replace(/\.\d{3}Z$/, 'Z').replace(/[-:]/g, '').replace('T', '-').replace('Z', '')}-${process.pid}`;
+}
+
+function buildRunScript(params: {
+  command: string[];
+  runDir: string;
+  runId: string;
+}): string {
+  const command = params.command.map(shellQuote).join(' ');
+  const runDir = shellQuote(params.runDir);
+  const runId = shellQuote(params.runId);
+  return `#!/bin/sh
+set -u
+cd /workspace
+date "+%Y-%m-%d %H:%M:%S%:z" > ${runDir}/started_at
+printf '%s\\n' running > ${runDir}/status
+${command}
+code=$?
+printf '%s\\n' "$code" > ${runDir}/exit_code
+date "+%Y-%m-%d %H:%M:%S%:z" > ${runDir}/finished_at
+if [ "$code" -eq 0 ]; then
+  printf '%s\\n' completed > ${runDir}/status
+else
+  printf '%s\\n' failed > ${runDir}/status
+fi
+printf '\\n[agent-infra] run %s finished with exit code %s\\n' ${runId} "$code"
+exec bash -l
+`;
+}
+
+function buildTmuxLauncher(params: {
+  request: SandboxCaptureRequest;
+  runId: string;
+}): string {
+  const session = 'work';
+  const window = `ai-${params.runId.replace(/^run-/, '').slice(0, 18)}`;
+  const runRoot = '/tmp/agent-infra-runs';
+  const runDir = `${runRoot}/${params.runId}`;
+  const runScript = buildRunScript({ command: params.request.command, runDir, runId: params.runId });
+  const runScriptBase64 = Buffer.from(runScript, 'utf8').toString('base64');
+  const paneCommand = `cd /workspace && ${shellQuote(`${runDir}/run.sh`)}`;
+
+  return `set -eu
+session=${shellQuote(session)}
+window=${shellQuote(window)}
+run_id=${shellQuote(params.runId)}
+run_dir=${shellQuote(runDir)}
+task_ref=${shellQuote(params.request.taskRef)}
+branch=${shellQuote(params.request.branch)}
+
+sandbox-dotfiles-link >/dev/null 2>&1 || true
+mkdir -p "$run_dir"
+printf '%s\\n' pending > "$run_dir/status"
+printf '%s\\n' "$task_ref" > "$run_dir/task_ref"
+printf '%s\\n' "$branch" > "$run_dir/branch"
+printf '%s\\n' ${shellQuote(params.request.command.join(' '))} > "$run_dir/command"
+printf '%s' ${shellQuote(runScriptBase64)} | base64 -d > "$run_dir/run.sh"
+chmod +x "$run_dir/run.sh"
+
+if ! command -v tmux >/dev/null 2>&1; then
+  printf '%s\\n' "tmux is not installed in this sandbox" >&2
+  exit 127
+fi
+
+if ! tmux has-session -t "$session" 2>/dev/null; then
+  tmux new-session -d -s "$session" -n shell
+fi
+
+if [ -n "\${TZ:-}" ]; then
+  tmux set-environment -t "$session" TZ "$TZ" 2>/dev/null || true
+fi
+
+pane=$(tmux new-window -d -P -F '#{pane_id}' -t "$session" -n "$window")
+printf '%s\\n' "$session" > "$run_dir/session"
+printf '%s\\n' "$window" > "$run_dir/window"
+printf '%s\\n' "$pane" > "$run_dir/pane"
+tmux pipe-pane -o -t "$pane" "cat > $run_dir/output.log"
+tmux send-keys -t "$pane" ${shellQuote(paneCommand)} Enter
+
+cat <<EOF
+Started sandbox run $run_id in tmux session '$session', window '$window', pane '$pane'.
+Attach with: ai sandbox enter $task_ref
+Status file: $run_dir/status
+Output log: $run_dir/output.log
+EOF
+`;
+}
+
+export async function runInSandbox(
+  request: SandboxCaptureRequest,
+  options: SandboxCaptureOptions = {}
+): Promise<SandboxCaptureResult> {
+  const config = options.engine ? null : loadConfig();
+  const engine = options.engine ?? detectEngine(config!);
+  const rows =
+    options.rows ??
+    (() => {
+      const fetched = fetchSandboxRows(engine, sandboxLabel(config!), sandboxBranchLabel(config!));
+      return [...fetched.running, ...fetched.nonRunning];
+    })();
+  const candidates = options.containerCandidates ?? containerNameCandidates(config!, request.branch);
+  const found = selectSandboxContainer(rows, candidates);
+  if (!found) {
+    throw new Error(
+      `Sandbox for ${request.branch} not found. Create it first with ai sandbox create ${request.taskRef}.`
+    );
+  }
+  if (!found.running) {
+    (options.startContainer ?? ((name: string) => startSandboxContainer(engine, name)))(found.name);
+  }
+  const runId = options.runId ?? createRunId();
+  const runDir = `/tmp/agent-infra-runs/${runId}`;
+  const dockerArgs = [
+    'exec',
+    ...terminalEnvFlags(),
+    ...hostTimezoneEnvFlags(),
+    found.name,
+    'bash',
+    '-lc',
+    buildTmuxLauncher({ request, runId })
+  ];
+  const result = await (options.spawn ?? spawnCapture)('docker', dockerArgs);
+  return {
+    ...result,
+    run: {
+      runId,
+      engine,
+      container: found.name,
+      runDir
+    }
+  };
+}

package/lib/sandbox/commands/create.ts

@@ -740,6 +740,63 @@ function readHostJsonSafe(filePath: string): JsonObject | null {
   }
 }
 
+const CLAUDE_SETTINGS_INHERIT_TOP_LEVEL_KEYS = [
+  'model',
+  'fallbackModel',
+  'availableModels',
+  'modelOverrides',
+  'enforceAvailableModels',
+  'advisorModel',
+  'apiKeyHelper',
+  'effortLevel'
+];
+
+function isJsonObjectRecord(value: unknown): value is JsonObject {
+  return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+
+function mergeMissingStringEnvFields(target: JsonObject, source: JsonObject): boolean {
+  if (!isJsonObjectRecord(source.env)) {
+    return false;
+  }
+  if (Object.hasOwn(target, 'env') && !isJsonObjectRecord(target.env)) {
+    return false;
+  }
+
+  let targetEnv = target.env as JsonObject | undefined;
+  let changed = false;
+  for (const [key, value] of Object.entries(source.env)) {
+    if (typeof value !== 'string' || value === '') {
+      continue;
+    }
+    if (!targetEnv) {
+      targetEnv = {};
+      target.env = targetEnv;
+    }
+    if (!Object.hasOwn(targetEnv, key)) {
+      targetEnv[key] = value;
+      changed = true;
+    }
+  }
+  return changed;
+}
+
+function mergeMissingTopLevelSettings(target: JsonObject, source: JsonObject): boolean {
+  let changed = false;
+  for (const key of CLAUDE_SETTINGS_INHERIT_TOP_LEVEL_KEYS) {
+    if (!Object.hasOwn(source, key) || Object.hasOwn(target, key)) {
+      continue;
+    }
+    const value = source[key];
+    if (value === null || value === undefined || value === '') {
+      continue;
+    }
+    target[key] = value;
+    changed = true;
+  }
+  return changed;
+}
+
 export function ensureClaudeOnboarding(toolDir: string, hostHomeDir?: string): void {
   const claudeJsonPath = path.join(toolDir, '.claude.json');
   let data: JsonObject & {
@@ -810,7 +867,7 @@ export function ensureClaudeOnboarding(toolDir: string, hostHomeDir?: string): v
 
 export function ensureClaudeSettings(toolDir: string, hostHomeDir?: string): void {
   const settingsPath = path.join(toolDir, 'settings.json');
-  let data: JsonObject & { skipDangerousModePermissionPrompt?: boolean; effortLevel?: string } = {};
+  let data: JsonObject & { skipDangerousModePermissionPrompt?: boolean } = {};
   if (fs.existsSync(settingsPath)) {
     try {
       data = JSON.parse(fs.readFileSync(settingsPath, 'utf8')) as typeof data;
@@ -825,14 +882,9 @@ export function ensureClaudeSettings(toolDir: string, hostHomeDir?: string): voi
   }
   if (hostHomeDir) {
     const hostSettings = readHostJsonSafe(path.join(hostHomeDir, '.claude', 'settings.json'));
-    if (
-      hostSettings
-      && typeof hostSettings.effortLevel === 'string'
-      && hostSettings.effortLevel !== ''
-      && !Object.hasOwn(data, 'effortLevel')
-    ) {
-      data.effortLevel = hostSettings.effortLevel;
-      changed = true;
+    if (hostSettings) {
+      changed = mergeMissingStringEnvFields(data, hostSettings) || changed;
+      changed = mergeMissingTopLevelSettings(data, hostSettings) || changed;
     }
   }
   if (changed) {
@@ -1386,9 +1438,9 @@ export async function create(args: string[]): Promise<void> {
             if (claudeCodeEntry) {
               ensureClaudeOnboarding(claudeCodeEntry.dir, effectiveConfig.home);
               ensureClaudeSettings(claudeCodeEntry.dir, effectiveConfig.home);
-              // prepareClaudeCredentials wrote the shared credentials file
-              // before this point. If credentials were missing, the
-              // claude-code entry was removed from effectiveResolvedTools.
+              // prepareClaudeCredentials wrote OAuth credentials or confirmed
+              // provider/API settings are enough for Claude Code. If no usable
+              // auth was present, the claude-code entry was removed above.
             }
             const codexEntry = effectiveResolvedTools.find(({ tool }) => tool.id === 'codex');
             if (codexEntry) {

package/lib/sandbox/commands/enter.ts

@@ -9,6 +9,7 @@ import { detectEngine } from '../engine.ts';
 import {
   formatCredentialWarnings,
   formatRemaining,
+  hasClaudeProviderAuth,
   reconcileClaudeCredentials,
   redactCommandError,
   validateClaudeCredentialsEnvOverride
@@ -93,8 +94,12 @@ export function runSandboxInteractive(params: {
 
 export function formatCredentialSyncStatus(
   result: ReturnType<typeof reconcileClaudeCredentials>,
-  isTTY = process.stderr.isTTY
+  isTTY = process.stderr.isTTY,
+  providerAuthAvailable = false
 ): string | null {
+  if (providerAuthAvailable && (result.status === 'STALE_ACCESS' || result.status === 'MISSING')) {
+    return null;
+  }
   if (result.status === 'STALE_ACCESS') {
     return 'Warning: Claude Code credentials on host appear stale. Run "ai sandbox refresh" or "claude /login" to renew.\n';
   }
@@ -158,8 +163,9 @@ export async function enter(args: string[]): Promise<number> {
   if (config.tools.includes('claude-code')) {
     try {
       // Scan all projects so a refresh from a neighbouring sandbox can still flow back to the host.
+      const providerAuthAvailable = hasClaudeProviderAuth(config.home);
       const result = reconcileClaudeCredentials(config.home);
-      const message = formatCredentialSyncStatus(result);
+      const message = formatCredentialSyncStatus(result, process.stderr.isTTY, providerAuthAvailable);
       if (message) {
         process.stderr.write(message);
       }