@integrity-labs/agt-cli 0.28.1006 → 0.28.1007

package/dist/{chunk-O6R6HS2Z.js → chunk-SQX4ZGD5.js}

@@ -39,6 +39,15 @@ import {
 import {
   reapOrphanChannelMcps
 } from "./chunk-XWVM4KPK.js";
+import {
+  CLAUDE_CONFIG_DIR_ENV,
+  archiveLegacyClaudeJson,
+  claudeConfigDirFor,
+  claudeConfigDirIsReady,
+  claudeJsonPathFor,
+  legacyClaudeJsonPathFor,
+  seedClaudeConfigFromLegacy
+} from "./chunk-EL5MWGGH.js";
 import {
   __require
 } from "./chunk-DGUM43GV.js";
@@ -2998,10 +3007,10 @@ function assessClaudeConfig(probe) {
   }
   return { verdict: "ok", detail: `${path} is valid (${raw.length} bytes)`, blocksSpawn: false };
 }
-function describeClaudeConfigForLog(homeDir) {
+function describeClaudeConfigForLog(claudeJsonFilePath) {
   try {
     const { readFileSync: readFileSync8, statSync: statSync2 } = __require("fs");
-    const path = `${homeDir.replace(/\/+$/, "")}/.claude.json`;
+    const path = claudeJsonFilePath;
     let raw = null;
     let readFailure;
     try {
@@ -4020,6 +4029,19 @@ function ensureClaudeStateLayout(args) {
   mkdirSync6(join7(projects, `${TRANSCRIPT_MASK_DIR_PREFIX}${args.agentId}`), { recursive: true });
   mkdirSync6(join7(projects, encodeClaudeProjectPath(args.projectDir)), { recursive: true });
 }
+function legacyClaudeJsonIsFile(path) {
+  try {
+    return lstatSync3(path).isFile();
+  } catch {
+    return false;
+  }
+}
+function configDirIsIsolationSafe(homeDir) {
+  return claudeConfigDirFor(homeDir) === join7(homeDir, ".claude");
+}
+function sessionHomeDirFor() {
+  return process.env.HOME?.trim() || homedir5();
+}
 function buildDockerRunCommand(args) {
   const { codeName, agentId, wrapperPath, projectDir, homeDir, runId, passApiKey, passOpenRouter, passModelPolicyGateway, passModelPolicyModel, egress, forwardSlackReplyBinding, forwardBlockTurnEndAllMarkers, forwardKanbanWaiting, forwardNotifyDispatch, forwardTimezone, forwardTurnFailureNotice, forwardChannelSecrets, agentClass } = args;
   const q = (s) => `'${s.replace(/'/g, `'\\''`)}'`;
@@ -4027,7 +4049,11 @@ function buildDockerRunCommand(args) {
   const agentIdDir = join7(homeDir, ".augmented", agentId);
   const mcpDir = join7(homeDir, ".augmented", "_mcp");
   const claudeHome = join7(homeDir, ".claude");
-  const claudeJson = join7(homeDir, ".claude.json");
+  const legacyClaudeJson = legacyClaudeJsonPathFor(homeDir);
+  const configDir = claudeConfigDirFor(homeDir);
+  const configDirIsolationSafe = configDirIsIsolationSafe(homeDir);
+  const useConfigDir = (args.claudeConfigDirReady ?? claudeConfigDirIsReady(homeDir)) && configDirIsolationSafe;
+  const legacyExists = args.legacyClaudeJsonExists ?? legacyClaudeJsonIsFile(legacyClaudeJson);
   const claudeProjects = join7(claudeHome, "projects");
   const transcriptMask = join7(claudeProjects, `${TRANSCRIPT_MASK_DIR_PREFIX}${agentId}`);
   const ownTranscripts = join7(claudeProjects, encodeClaudeProjectPath(projectDir));
@@ -4041,7 +4067,13 @@ function buildDockerRunCommand(args) {
     `-v ${q(`${claudeHome}:${claudeHome}`)}`,
     `-v ${q(`${transcriptMask}:${claudeProjects}`)}`,
     `-v ${q(`${ownTranscripts}:${ownTranscripts}`)}`,
-    `-v ${q(`${claudeJson}:${claudeJson}`)}`,
+    // ENG-10869: a single-FILE bind pins the inode at container start, and
+    // Claude Code replaces this file by atomic rename - so every host write
+    // orphaned the container's view until respawn (six live versions across
+    // eight agents, agt-aws-1 2026-09-22). Once the config dir holds the file
+    // it is reached through the `${claudeHome}` DIRECTORY mount above, where
+    // renames propagate both ways and a container can write atomically.
+    ...useConfigDir || !legacyExists ? [] : [`-v ${q(`${legacyClaudeJson}:${legacyClaudeJson}`)}`],
     // ENG-8854: the rest of the per-session state, from the agent's own id-keyed tree.
     ...CLAUDE_PER_AGENT_DIRS.map(
       (name) => `-v ${q(`${join7(claudeStateDirFor(homeDir, agentId), name)}:${join7(claudeHome, name)}`)}`
@@ -4055,6 +4087,7 @@ function buildDockerRunCommand(args) {
   const cpus = process.env.AGT_ISOLATION_CPUS || "1.0";
   const pids = process.env.AGT_ISOLATION_PIDS || "512";
   const envArgs = [`-e ${q(`HOME=${homeDir}`)}`];
+  if (useConfigDir) envArgs.push(`-e ${q(`${CLAUDE_CONFIG_DIR_ENV}=${configDir}`)}`);
   envArgs.push(`-e ${q(`npm_config_cache=${join7(agentDir2, ".npm-cache")}`)}`);
   envArgs.push(`-e ${q(`${CLAUDE_CODE_TMPDIR_ENV}=${agentTmpDirFor(agentDir2)}`)}`);
   if (passApiKey) envArgs.push("-e ANTHROPIC_API_KEY");
@@ -4761,6 +4794,13 @@ function spawnSession(config, session) {
     });
     const tmuxSessionEnvArgs = [];
     tmuxSessionEnvArgs.push("-e", `AGT_AGENT_ID=${config.agentId}`);
+    const tmuxSessionHomeDir = sessionHomeDirFor();
+    if (claudeConfigDirIsReady(tmuxSessionHomeDir)) {
+      tmuxSessionEnvArgs.push(
+        "-e",
+        `${CLAUDE_CONFIG_DIR_ENV}=${claudeConfigDirFor(tmuxSessionHomeDir)}`
+      );
+    }
     tmuxSessionEnvArgs.push(
       "-e",
       `${CLAUDE_CODE_TMPDIR_ENV}=${agentTmpDirFor(dirname5(config.projectDir))}`
@@ -4805,7 +4845,7 @@ function spawnSession(config, session) {
     for (const [key, value] of Object.entries(config.channelSpawnSecrets ?? {})) {
       tmuxSessionEnvArgs.push("-e", `${key}=${value}`);
     }
-    const sessionHomeDir = process.env.HOME?.trim() || homedir5();
+    const sessionHomeDir = sessionHomeDirFor();
     const effectiveMode = effectiveIsolationMode(codeName, log2);
     let egress;
     if (effectiveMode === "docker" && egressMode(codeName) === "allowlist") {
@@ -4818,6 +4858,30 @@ function spawnSession(config, session) {
       ensureClaudeStateLayout({ homeDir: sessionHomeDir, agentId: config.agentId, projectDir });
     }
     const claudeCmd = effectiveMode === "docker" ? buildDockerRunCommand({
+      // ENG-10869: seed-then-decide, in that order and in one place. A
+      // container handed CLAUDE_CONFIG_DIR before the file exists there
+      // starts against an empty config - credentials resolve, identity does
+      // not, and that is the login picker. So the seed runs first and this
+      // flag reports what actually landed, rather than what we intended.
+      claudeConfigDirReady: (() => {
+        seedClaudeConfigFromLegacy({ homeDir: sessionHomeDir, log: log2 });
+        const ready = claudeConfigDirIsReady(sessionHomeDir);
+        if (!ready) return false;
+        if (!configDirIsIsolationSafe(sessionHomeDir)) {
+          log2(
+            `[claude-config] NOT archiving for '${codeName}': ${claudeConfigDirFor(sessionHomeDir)} is not under ${join7(sessionHomeDir, ".claude")}, so directory mode is refused and the legacy bind is what this container will use`
+          );
+          return false;
+        }
+        const archived = archiveLegacyClaudeJson({ homeDir: sessionHomeDir, log: log2 });
+        if (archived === "refused-legacy-newer" || archived === "failed") {
+          log2(
+            `[claude-config] staying on the legacy bind for '${codeName}': archive=${archived}`
+          );
+          return false;
+        }
+        return true;
+      })(),
       codeName,
       agentId: config.agentId,
       wrapperPath,
@@ -5108,7 +5172,7 @@ async function acceptDialogs(tmuxSession, codeName, log2, primaryModel = null, s
       if (isLoginPickerVisible(screen)) {
         noteSessionBlockedOnPrompt(codeName, "login-picker", "spawn-dialogs");
         if (!loginPickerReported) {
-          const health = describeClaudeConfigForLog(homedir5());
+          const health = describeClaudeConfigForLog(claudeJsonPathFor());
           if (health) {
             log2(`[persistent-session] CLAUDE LOGIN REQUIRED for '${codeName}' \u2014 ${health}`);
           } else {
@@ -5731,6 +5795,7 @@ export {
   CLAUDE_HOST_WIDE,
   claudeStateDirFor,
   ensureClaudeStateLayout,
+  configDirIsIsolationSafe,
   buildDockerRunCommand,
   writePersistentClaudeWrapper,
   PANE_AGENT_ID_PROBE_TIMEOUT_MS,
@@ -5776,4 +5841,4 @@ export {
   stopAllSessionsAndWait,
   getProjectDir
 };
-//# sourceMappingURL=chunk-O6R6HS2Z.js.map
+//# sourceMappingURL=chunk-SQX4ZGD5.js.map