@joshski/dust 0.1.101 → 0.1.102

package/dist/dust.js

@@ -7,7 +7,7 @@ var __require = /* @__PURE__ */ createRequire(import.meta.url);
 var require_package = __commonJS((exports, module) => {
   module.exports = {
     name: "@joshski/dust",
-    version: "0.1.101",
+    version: "0.1.102",
     description: "Flow state for AI coding agents",
     type: "module",
     bin: {
@@ -131,6 +131,19 @@ function formatLine(name, messages) {
   return `${new Date().toISOString()} [${name}] ${text}
 `;
 }
+function formatJsonLine(entry) {
+  return JSON.stringify(entry) + `
+`;
+}
+function createLogEntry(name, message, context) {
+  return {
+    ts: new Date().toISOString(),
+    logger: name,
+    level: "info",
+    msg: message,
+    ...context
+  };
+}
 
 // lib/logging/sink.ts
 import { appendFileSync, mkdirSync } from "node:fs";
@@ -212,9 +225,10 @@ function createLoggingService(options) {
       } else if (typeof loggerOptions?.file === "string") {
         perLoggerSink = getOrCreateFileSink(loggerOptions.file);
       }
-      return (...messages) => {
+      const useJsonFormat = config.logFormat === "json";
+      return (message, context) => {
         init();
-        const line = formatLine(name, messages);
+        const line = useJsonFormat ? formatJsonLine(createLogEntry(name, message, context)) : formatLine(name, [message, ...context ? [context] : []]);
         if (perLoggerSink !== undefined) {
           if (perLoggerSink !== null) {
             perLoggerSink.write(line);
@@ -237,7 +251,8 @@ var defaultService = createLoggingService({
   config: {
     debug: process.env.DEBUG,
     logDir: process.env.DUST_LOG_DIR,
-    logFile: process.env.DUST_LOG_FILE
+    logFile: process.env.DUST_LOG_FILE,
+    logFormat: process.env.DUST_LOG_FORMAT === "json" ? "json" : process.env.DUST_LOG_FORMAT === "text" ? "text" : undefined
   }
 });
 var enableFileLogs = defaultService.enableFileLogs.bind(defaultService);
@@ -293,12 +308,19 @@ function createCommandEventWriter(env = process.env, dependencies = defaultDepen
 }
 
 // lib/env-config.ts
+function parseLogFormat(value) {
+  if (value === "json" || value === "text") {
+    return value;
+  }
+  return;
+}
 function readEnvConfig(env) {
   return {
     logging: {
       debug: env.DEBUG,
       logDir: env.DUST_LOG_DIR,
-      logFile: env.DUST_LOG_FILE
+      logFile: env.DUST_LOG_FILE,
+      logFormat: parseLogFormat(env.DUST_LOG_FORMAT)
     },
     bucket: {
       host: env.DUST_BUCKET_HOST,
@@ -663,7 +685,7 @@ async function loadSettings(cwd, fileSystem, runtime) {
 }
 
 // lib/version.ts
-var DUST_VERSION = "0.1.101";
+var DUST_VERSION = "0.1.102";
 
 // lib/session.ts
 var DUST_UNATTENDED = "DUST_UNATTENDED";
@@ -1087,11 +1109,12 @@ function checksAuditTemplate() {
     - Created ideas for each missing check category
     - For multi-ecosystem projects, created separate ideas per ecosystem
     - Each idea includes suggested command and alternatives
+    - No changes to files outside \`.dust/\`
   `;
 }
 
 // lib/audits/stock-audits.ts
-var ideasHint = "Review existing ideas in `./.dust/ideas/` to understand what has been proposed or considered historically, then create new idea files in `./.dust/ideas/` for any issues you identify, avoiding duplication.";
+var ideasHint = "Review existing ideas in `./.dust/ideas/` to understand what has been proposed or considered historically, then create new idea files in `./.dust/ideas/` for any issues you identify, avoiding duplication. Do not modify source code - create ideas instead.";
 function dataAccessReview() {
   return dedent`
     # Data Access Review
@@ -1142,6 +1165,7 @@ function dataAccessReview() {
     - Checked for sequential operations that could be batched
     - Verified connection/resource cleanup is handled properly
     - Proposed ideas for any data access improvements identified
+    - No changes to files outside \`.dust/\`
   `;
 }
 function coverageExclusions() {
@@ -1189,6 +1213,7 @@ function coverageExclusions() {
     - Labeled justification quality for visibility
     - Identified exclusions that could be removed through decoupling
     - Proposed ideas for refactoring where feasible
+    - No changes to files outside \`.dust/\`
   `;
 }
 function componentReuse() {
@@ -1219,6 +1244,7 @@ function componentReuse() {
     - Evaluated each case for whether extraction would be beneficial
     - Considered whether similar code serves different purposes that may evolve independently
     - Proposed ideas only for extractions where duplication is truly about the same concept
+    - No changes to files outside \`.dust/\`
   `;
 }
 function agentDeveloperExperience() {
@@ -1250,6 +1276,7 @@ function agentDeveloperExperience() {
     - Measured feedback loop speed (time from change to check result)
     - Confirmed debugging tools and structured logging are in place
     - Proposed ideas for any improvements identified
+    - No changes to files outside \`.dust/\`
   `;
 }
 function agentInstructionQuality() {
@@ -1414,6 +1441,7 @@ function agentInstructionQuality() {
     - Found instructions that could be replaced by linter rules
     - Documented each issue with location, type, impact, and suggestion
     - Created ideas for substantial instruction improvements
+    - No changes to files outside \`.dust/\`
   `;
 }
 function deadCode() {
@@ -1447,6 +1475,7 @@ function deadCode() {
     - Created list of code safe to remove
     - Verified removal won't break dynamic imports or reflection
     - Proposed ideas for any dead code worth removing
+    - No changes to files outside \`.dust/\`
   `;
 }
 function documentationDrift() {
@@ -1560,6 +1589,7 @@ function documentationDrift() {
     - Reviewed inline comments for outdated descriptions
     - Documented each drift finding with location, claim, reality, and suggested fix
     - Created ideas for any substantial documentation updates needed
+    - No changes to files outside \`.dust/\`
   `;
 }
 function factsVerification() {
@@ -1595,6 +1625,7 @@ function factsVerification() {
     - Listed missing facts that would help agents
     - Updated or removed stale facts
     - Proposed ideas for any facts improvements needed
+    - No changes to files outside \`.dust/\`
   `;
 }
 function feedbackLoopSpeed() {
@@ -1721,6 +1752,7 @@ function feedbackLoopSpeed() {
     - Flagged dominant checks (>30% of total time)
     - Documented findings in summary table format
     - Created ideas for any feedback loop speed improvements identified
+    - No changes to files outside \`.dust/\`
   `;
 }
 function ideasFromPrinciples() {
@@ -1754,6 +1786,7 @@ function ideasFromPrinciples() {
     - Analyzed codebase for alignment with each principle
     - Listed gaps between current state and principle intent
     - Proposed new ideas for unmet or underserved principles
+    - No changes to files outside \`.dust/\`
   `;
 }
 function commitReview() {
@@ -1806,6 +1839,7 @@ function commitReview() {
     - Noted areas where changes could be generalized
     - Provided specific suggestions for each opportunity
     - Created ideas for any substantial work identified
+    - No changes to files outside \`.dust/\`
   `;
 }
 function securityReview() {
@@ -1870,6 +1904,7 @@ function securityReview() {
     - Ran lightweight pattern scan for obvious issues (documented as supplementary)
     - Created ideas for any missing security tooling categories
     - Each idea specifies which tool to add and where to configure it
+    - No changes to files outside \`.dust/\`
   `;
 }
 function staleIdeas() {
@@ -1904,6 +1939,7 @@ function staleIdeas() {
     - Reviewed each stale idea for current relevance
     - Promoted actionable ideas to tasks
     - Deleted ideas that are no longer relevant
+    - No changes to files outside \`.dust/\`
   `;
 }
 function errorHandling() {
@@ -1952,6 +1988,7 @@ function errorHandling() {
     - Reviewed error messages for actionability
     - Compared error handling consistency across similar operations
     - Proposed ideas for any error handling improvements identified
+    - No changes to files outside \`.dust/\`
   `;
 }
 function globalState() {
@@ -2002,6 +2039,7 @@ function globalState() {
     - Checked for scattered process.env access
     - Documented impact of each global state instance on testing
     - Proposed ideas for refactoring global state to explicit dependencies
+    - No changes to files outside \`.dust/\`
   `;
 }
 function repositoryContext() {
@@ -2051,6 +2089,7 @@ function repositoryContext() {
     - Design philosophy or guiding approach is captured
     - Document is concise enough to fit comfortably in an agent context window
     - A new agent reading only this document could make sensible high-level suggestions
+    - No changes to files outside \`.dust/\`
   `;
 }
 function slowTests() {
@@ -2103,6 +2142,7 @@ function slowTests() {
     - Reviewed beforeEach/beforeAll for optimization opportunities
     - Checked test parallelization configuration
     - Proposed ideas for optimizing the slowest tests
+    - No changes to files outside \`.dust/\`
   `;
 }
 function primitiveObsession() {
@@ -2171,6 +2211,7 @@ function primitiveObsession() {
     - Preserved Functional Core, Imperative Shell boundaries in recommendations
     - Avoided speculative introduction of entirely new types
     - Proposed ideas for primitive obsession improvements identified
+    - No changes to files outside \`.dust/\`
   `;
 }
 function singleResponsibilityViolations() {
@@ -2229,6 +2270,7 @@ function singleResponsibilityViolations() {
     - Preserved Functional Core, Imperative Shell boundaries in recommendations
     - Kept recommendations high-confidence only with clear concern boundaries
     - Proposed ideas for substantial responsibility-splitting work identified
+    - No changes to files outside \`.dust/\`
   `;
 }
 function ubiquitousLanguage() {
@@ -2293,6 +2335,7 @@ function ubiquitousLanguage() {
     - Reviewed factory/constructor naming for \`build*\`, \`create*\`, \`make*\`, \`new*\` consistency
     - Documented any terminology drift or inconsistencies found
     - Proposed ideas for standardizing inconsistent terminology
+    - No changes to files outside \`.dust/\`
   `;
 }
 function designPatterns() {
@@ -2360,6 +2403,7 @@ function designPatterns() {
     - Documented each finding with location, code smell, recommended pattern, trade-offs, and migration complexity
     - Noted tech-stack considerations where Gang of Four patterns may or may not apply
     - Proposed ideas for any design pattern improvements identified
+    - No changes to files outside \`.dust/\`
   `;
 }
 function testAssertions() {
@@ -2511,6 +2555,7 @@ function testAssertions() {
     - Found tests covering multiple unrelated behaviors
     - Documented each finding with location, pattern, impact, and suggestion
     - Proposed ideas for any assertion quality improvements identified
+    - No changes to files outside \`.dust/\`
   `;
 }
 function algorithms() {
@@ -2564,6 +2609,7 @@ function algorithms() {
     - Checked recursive graph/tree operations for cycle protection
     - Documented each finding with function name, location, complexity, data structures, optimization, and acceptability assessment
     - Proposed ideas for any algorithmic improvements identified
+    - No changes to files outside \`.dust/\`
   `;
 }
 function loggingAndTraceability() {
@@ -2616,6 +2662,7 @@ function loggingAndTraceability() {
     - Assessed whether running the application produces understandable output
     - Tested whether logs help diagnose common failure scenarios
     - Proposed ideas for any logging improvements identified
+    - No changes to files outside \`.dust/\`
   `;
 }
 function testPyramid() {
@@ -2697,6 +2744,7 @@ function testPyramid() {
     - Identified miscategorized tests (e.g., unit tests with I/O)
     - Provided specific recommendations to improve pyramid shape
     - Proposed ideas for any substantial test restructuring needed
+    - No changes to files outside \`.dust/\`
   `;
 }
 function idiomaticStyle() {
@@ -2758,6 +2806,7 @@ function idiomaticStyle() {
     - Evaluated code style consistency with rest of codebase
     - Identified anti-patterns or deprecated approaches
     - Proposed ideas for any idiomaticity improvements identified
+    - No changes to files outside \`.dust/\`
   `;
 }
 function uxAudit() {
@@ -2822,6 +2871,7 @@ function uxAudit() {
     - Documented findings with evidence and recommendations
     - Included verification criteria for each issue
     - Created ideas for any UX improvements needed
+    - No changes to files outside \`.dust/\`
   `;
 }
 function dependencyHealth() {
@@ -2964,6 +3014,7 @@ function dependencyHealth() {
     - Searched for packages with known better-maintained alternatives
     - Documented each concern with package name, version, type, and suggested action
     - Created ideas for any dependency health improvements needed
+    - No changes to files outside \`.dust/\`
   `;
 }
 function ciDevelopmentParity() {
@@ -3121,6 +3172,7 @@ function ciDevelopmentParity() {
     - Identified CI-only checks (in CI but not dust)
     - Created idea files for each gap with suggested fix
     - Each idea links to relevant principles
+    - No changes to files outside \`.dust/\`
   `;
 }
 function commitMessageQuality() {
@@ -3270,6 +3322,7 @@ function commitMessageQuality() {
     - Identified commits missing links to issues/tasks
     - Created idea files for patterns found
     - Each idea includes concrete suggestions for improvement
+    - No changes to files outside \`.dust/\`
   `;
 }
 function suggestAudits() {
@@ -3359,6 +3412,7 @@ function suggestAudits() {
     - Identified relevant audits based on change patterns
     - Created task files for each suggested audit with rationale
     - Each task explains why the audit is valuable given recent changes
+    - No changes to files outside \`.dust/\`
   `;
   return content;
 }
@@ -4072,6 +4126,12 @@ import { dirname as dirname2 } from "node:path";
 import { spawn as nodeSpawn } from "node:child_process";
 import { createInterface as nodeCreateInterface } from "node:readline";
 var debug = createLogger("dust.claude.spawn-claude-code");
+function generateApiKeyHelperSettings(proxyUrl) {
+  const settings = {
+    apiKeyHelper: `curl -fsS --max-time 2 ${proxyUrl}/token | tr -d '\\n'`
+  };
+  return JSON.stringify(settings, null, 2);
+}
 var defaultDependencies2 = {
   spawn: nodeSpawn,
   createInterface: nodeCreateInterface
@@ -4097,7 +4157,11 @@ function buildDockerRunArguments(docker, claudeArguments, env) {
   }
   if (docker.claudeApiProxyUrl) {
     dockerArguments.push("-e", `ANTHROPIC_BASE_URL=${docker.claudeApiProxyUrl}`);
-    dockerArguments.push("-e", "ANTHROPIC_AUTH_TOKEN=proxy-managed");
+    if (docker.settingsFilePath) {
+      const containerSettingsPath = "/home/user/.dust-settings.json";
+      dockerArguments.push("-v", `${docker.settingsFilePath}:${containerSettingsPath}:ro`);
+      claudeArguments.push("--settings", containerSettingsPath);
+    }
   }
   const gitIdentityDefaults = {
     GIT_AUTHOR_NAME: "Dust Agent",
@@ -4202,7 +4266,7 @@ async function* spawnClaudeCode(prompt, options = {}, dependencies = defaultDepe
       try {
         yield JSON.parse(line);
       } catch {
-        debug("Skipping malformed JSON line: %s", line.slice(0, 200));
+        debug(`Skipping malformed JSON line: ${line.slice(0, 200)}`);
       }
     }
     await closePromise;
@@ -4528,8 +4592,8 @@ function processEvent(event, sink, state) {
 }
 function createStdoutSink() {
   return {
-    write: (text) => process.stdout.write(text),
-    line: (text) => console.log(text)
+    write: process.stdout.write.bind(process.stdout),
+    line: console.log.bind(console)
   };
 }
 
@@ -4657,8 +4721,9 @@ async function removeRepository(path, spawn, context) {
 }
 
 // lib/bucket/repository-loop.ts
-import { existsSync as fsExistsSync } from "node:fs";
+import { existsSync as fsExistsSync, unlinkSync, writeFileSync } from "node:fs";
 import os2 from "node:os";
+import { join as join9 } from "node:path";
 
 // lib/agent-events.ts
 function rawEventToAgentEvent(rawEvent, provider) {
@@ -4756,7 +4821,7 @@ function formatLoopEvent(event) {
 }
 
 // lib/loop/iteration.ts
-import { spawn as nodeSpawn2 } from "node:child_process";
+import { execSync, spawn as nodeSpawn2 } from "node:child_process";
 import os from "node:os";
 
 // lib/cli/process-runner.ts
@@ -5636,7 +5701,39 @@ async function runOneIteration(dependencies, loopDependencies, onLoopEvent, onAg
   const taskContent = await fileSystem.readFile(`${context.cwd}/${task.path}`);
   const instructions = buildImplementationInstructions(settings.dustCommand, hooksInstalled, task.title ?? undefined, task.path, settings.installCommand, true);
   const taskPrompt = buildTaskPrompt(task.path, taskContent, instructions, toolsSection, options.branch);
-  return executeTask(task, { run: run2, prompt: taskPrompt, spawnOptions, onRawEvent }, onAgentEvent, context, agentName, agentType, logger);
+  let originalRemoteUrl;
+  if (docker?.gitProxyUrl) {
+    try {
+      originalRemoteUrl = execSync("git remote get-url origin", {
+        cwd: context.cwd,
+        encoding: "utf-8"
+      }).trim();
+      const proxyUrl = originalRemoteUrl.replace(/^https:\/\/github\.com\//, `${docker.gitProxyUrl}/github.com/`);
+      if (proxyUrl !== originalRemoteUrl) {
+        execSync(`git remote set-url origin "${proxyUrl}"`, {
+          cwd: context.cwd
+        });
+        log2(`set remote URL to proxy: ${proxyUrl}`);
+      }
+    } catch {
+      log2("warning: failed to rewrite remote URL for Docker proxy");
+      originalRemoteUrl = undefined;
+    }
+  }
+  try {
+    return await executeTask(task, { run: run2, prompt: taskPrompt, spawnOptions, onRawEvent }, onAgentEvent, context, agentName, agentType, logger);
+  } finally {
+    if (originalRemoteUrl) {
+      try {
+        execSync(`git remote set-url origin "${originalRemoteUrl}"`, {
+          cwd: context.cwd
+        });
+        log2(`restored remote URL: ${originalRemoteUrl}`);
+      } catch {
+        log2("warning: failed to restore original remote URL");
+      }
+    }
+  }
 }
 function buildCheckFixPrompt(dustCommand, checkOutput) {
   return `Note: Do NOT run \`${dustCommand} agent\`.
@@ -5739,7 +5836,7 @@ async function* spawnCodex(prompt, options = {}, dependencies = defaultDependenc
       try {
         yield JSON.parse(line);
       } catch {
-        debug2("Skipping malformed JSON line: %s", line.slice(0, 200));
+        debug2(`Skipping malformed JSON line: ${line.slice(0, 200)}`);
       }
     }
     await closePromise;
@@ -5898,12 +5995,53 @@ import { readFileSync } from "node:fs";
 import { createServer as httpCreateServer } from "node:http";
 import { homedir } from "node:os";
 import { join as join8 } from "node:path";
+
+// lib/proxy/helper-token.ts
+var HELPER_TOKEN_TTL_MS = 60000;
+function generateRandomHex(length) {
+  const bytes = new Uint8Array(Math.ceil(length / 2));
+  crypto.getRandomValues(bytes);
+  return Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("").slice(0, length);
+}
+function generateHelperToken(now = Date.now()) {
+  const randomPart = generateRandomHex(56);
+  const token = `sk-ant-api03-${randomPart}`;
+  return {
+    token,
+    issuedAt: now
+  };
+}
+function isHelperTokenValid(token, issued, now = Date.now(), ttlMs = HELPER_TOKEN_TTL_MS) {
+  if (token !== issued.token) {
+    return false;
+  }
+  const elapsed = now - issued.issuedAt;
+  return elapsed >= 0 && elapsed < ttlMs;
+}
+function createHelperTokenState() {
+  return {
+    current: null
+  };
+}
+function rotateHelperToken(state, now = Date.now()) {
+  return {
+    current: generateHelperToken(now)
+  };
+}
+function isCurrentTokenValid(state, now = Date.now(), ttlMs = HELPER_TOKEN_TTL_MS) {
+  if (!state.current) {
+    return false;
+  }
+  return isHelperTokenValid(state.current.token, state.current, now, ttlMs);
+}
+
+// lib/proxy/claude-api-proxy.ts
 var log4 = createLogger("dust:proxy:claude-api");
 var ANTHROPIC_API_HOST = "https://api.anthropic.com";
 var OAUTH_BETA_FLAG = "oauth-2025-04-20";
 var defaultDependencies4 = {
   homedir,
-  readFileSync: (path2, encoding) => readFileSync(path2, encoding),
+  readFileSync,
   fetch
 };
 function readOAuthToken(dependencies = defaultDependencies4) {
@@ -5984,6 +6122,48 @@ function buildNoTokenResponse() {
     body: "Could not obtain OAuth token"
   };
 }
+function buildInvalidHelperTokenResponse() {
+  return {
+    statusCode: 401,
+    contentType: "text/plain",
+    body: "Invalid or expired helper token"
+  };
+}
+function extractHelperToken(headers) {
+  const authHeader = headers["authorization"];
+  if (typeof authHeader === "string") {
+    const bearerMatch = authHeader.match(/^Bearer\s+(.+)$/i);
+    if (bearerMatch) {
+      return bearerMatch[1];
+    }
+  }
+  const apiKey = headers["x-api-key"];
+  if (typeof apiKey === "string") {
+    return apiKey;
+  }
+  return null;
+}
+function validateHelperToken(incomingToken, state, now = Date.now()) {
+  if (!incomingToken || !state.current) {
+    return false;
+  }
+  return isHelperTokenValid(incomingToken, state.current, now);
+}
+function getOrRefreshHelperToken(state, now = Date.now()) {
+  if (!isCurrentTokenValid(state, now)) {
+    const newState = rotateHelperToken(state, now);
+    return { state: newState, token: newState.current.token };
+  }
+  return { state, token: state.current.token };
+}
+function buildTokenResponse(token) {
+  return {
+    kind: "error",
+    status: 200,
+    contentType: "text/plain",
+    body: token
+  };
+}
 function buildUpstreamErrorResponse(error) {
   const message = error instanceof Error ? error.message : "Unknown error";
   return {
@@ -5992,8 +6172,21 @@ function buildUpstreamErrorResponse(error) {
     body: `Upstream request failed: ${message}`
   };
 }
-async function handleProxyRequest(request, dependencies) {
+async function handleProxyRequest(request, dependencies, helperTokenState, now = Date.now()) {
   log4(`${request.method} ${request.pathname}${request.search}`);
+  if (helperTokenState) {
+    const incomingToken = extractHelperToken(request.headers);
+    if (!validateHelperToken(incomingToken, helperTokenState, now)) {
+      log4("invalid or expired helper token");
+      const errorResponse = buildInvalidHelperTokenResponse();
+      return {
+        kind: "error",
+        status: errorResponse.statusCode,
+        contentType: errorResponse.contentType,
+        body: errorResponse.body
+      };
+    }
+  }
   const token = readOAuthToken(dependencies);
   if (!token) {
     const errorResponse = buildNoTokenResponse();
@@ -6070,9 +6263,17 @@ async function readNodeRequestBody(nodeRequest) {
 }
 async function createClaudeApiProxyServer(dependencies = defaultDependencies4) {
   let resolvedPort = 0;
+  let helperTokenState = createHelperTokenState();
   const server = httpCreateServer(async (nodeRequest, nodeResponse) => {
     const method = nodeRequest.method ?? "GET";
     const url = new URL(nodeRequest.url ?? "/", `http://localhost:${resolvedPort}`);
+    if (url.pathname === "/token" && method === "GET") {
+      const result = getOrRefreshHelperToken(helperTokenState);
+      helperTokenState = result.state;
+      const response = buildTokenResponse(result.token);
+      await writeProxyResponse(response, nodeResponse);
+      return;
+    }
     const body = await readNodeRequestBody(nodeRequest);
     const proxyRequest = {
       method,
@@ -6081,7 +6282,7 @@ async function createClaudeApiProxyServer(dependencies = defaultDependencies4) {
       headers: nodeRequest.headers,
       body
     };
-    const proxyResponse = await handleProxyRequest(proxyRequest, dependencies);
+    const proxyResponse = await handleProxyRequest(proxyRequest, dependencies, helperTokenState);
     await writeProxyResponse(proxyResponse, nodeResponse);
   });
   await new Promise((resolve) => {
@@ -6121,9 +6322,13 @@ function parseGitPath(urlPath) {
 }
 async function getGitCredentials(host, dependencies) {
   return new Promise((resolve) => {
-    const proc = dependencies.spawn("git", ["credential", "fill"], {
+    const spawnOptions = {
       stdio: ["pipe", "pipe", "pipe"]
-    });
+    };
+    if (dependencies.userHome) {
+      spawnOptions.env = { ...process.env, HOME: dependencies.userHome };
+    }
+    const proc = dependencies.spawn("git", ["credential", "fill"], spawnOptions);
     const input = `protocol=https
 host=${host}
 
@@ -6240,13 +6445,14 @@ async function createGitCredentialProxyServer(dependencies) {
     if (nodeRequest.headers["content-type"]) {
       headers["Content-Type"] = nodeRequest.headers["content-type"];
     }
-    log5(`forwarding to ${upstreamUrl.toString()}`);
+    log5(`forwarding ${method} to ${upstreamUrl.toString()}${body ? ` (${body.length} bytes)` : ""}`);
     try {
       const upstreamResponse = await fetch(upstreamUrl.toString(), {
         method,
         headers,
         body
       });
+      log5(`upstream ${method} ${endpointInfo.endpoint} responded: ${upstreamResponse.status}`);
       const responseHeaders = {};
       upstreamResponse.headers.forEach((value, key) => {
         if (key.toLowerCase() !== "transfer-encoding") {
@@ -6756,15 +6962,24 @@ async function setupDockerConfig(repoState, repoDeps, onLoopEvent) {
       shouldExit: true
     };
   }
-  const gitProxy = await createGitCredentialProxyServer({ spawn: spawn2 });
+  const gitProxy = await createGitCredentialProxyServer({
+    spawn: spawn2,
+    userHome: process.env.DUST_USER_HOME || undefined
+  });
   log7(`git credential proxy started on port ${gitProxy.port}`);
   const apiProxy = await createClaudeApiProxyServer();
   log7(`claude api proxy started on port ${apiProxy.port}`);
+  const claudeApiProxyUrl = `http://host.docker.internal:${apiProxy.port}`;
+  const settingsFilePath = join9(os2.tmpdir(), `dust-claude-settings-${repoState.repository.name.replace(/\//g, "-")}.json`);
+  const settingsContent = generateApiKeyHelperSettings(claudeApiProxyUrl);
+  writeFileSync(settingsFilePath, settingsContent, "utf-8");
+  log7(`created settings file at ${settingsFilePath}`);
   return {
     config: {
       ...dockerResult.config,
       gitProxyUrl: `http://host.docker.internal:${gitProxy.port}`,
-      claudeApiProxyUrl: `http://host.docker.internal:${apiProxy.port}`
+      claudeApiProxyUrl,
+      settingsFilePath
     },
     stopGitProxy: gitProxy.stop,
     stopApiProxy: apiProxy.stop,
@@ -6803,7 +7018,7 @@ function handleNoTasksResult(repoState, repoName) {
   appendLogLine(repoState.logBuffer, createLogLine("Waiting for tasks...", "stdout"));
   return false;
 }
-function cleanupDockerProxies(repoName, stopGitProxy, stopApiProxy) {
+function cleanupDockerProxies(repoName, stopGitProxy, stopApiProxy, dockerConfig) {
   if (stopGitProxy) {
     stopGitProxy();
     log7(`git credential proxy stopped for ${repoName}`);
@@ -6812,6 +7027,12 @@ function cleanupDockerProxies(repoName, stopGitProxy, stopApiProxy) {
     stopApiProxy();
     log7(`claude api proxy stopped for ${repoName}`);
   }
+  if (dockerConfig?.settingsFilePath) {
+    try {
+      unlinkSync(dockerConfig.settingsFilePath);
+      log7(`cleaned up settings file ${dockerConfig.settingsFilePath}`);
+    } catch {}
+  }
 }
 async function runRepositoryLoop(repoState, repoDeps, sendEvent, sessionId) {
   const { spawn: spawn2, run: run3, fileSystem, sleep, runtime } = repoDeps;
@@ -6880,7 +7101,7 @@ async function runRepositoryLoop(repoState, repoDeps, sendEvent, sessionId) {
       await waitForTasks(repoState, sleep);
     }
   }
-  cleanupDockerProxies(repoName, dockerSetup.stopGitProxy, dockerSetup.stopApiProxy);
+  cleanupDockerProxies(repoName, dockerSetup.stopGitProxy, dockerSetup.stopApiProxy, dockerSetup.config);
   log7(`loop stopped for ${repoName}`);
   appendLogLine(repoState.logBuffer, createLogLine(`Stopped loop for ${repoName}`, "stdout"));
 }
@@ -8093,9 +8314,9 @@ function adaptWebSocket(ws) {
     emitter.emit("message", { data: String(event.data) });
   });
   return {
-    addEventListener: (type, handler) => emitter.on(type, handler),
-    close: () => ws.close(),
-    send: (data) => ws.send(data),
+    addEventListener: emitter.on.bind(emitter),
+    close: ws.close.bind(ws),
+    send: ws.send.bind(ws),
     get readyState() {
       return currentReadyState;
     }
@@ -8128,7 +8349,7 @@ function defaultSetupKeypress(onKey) {
   };
 }
 function defaultSetupSignals(onSignal) {
-  const handler = () => onSignal();
+  const handler = onSignal;
   process.on("SIGINT", handler);
   process.on("SIGTERM", handler);
   return () => {
@@ -8224,7 +8445,7 @@ function createDefaultBucketDependencies() {
     isTTY: process.stdout.isTTY ?? false,
     sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
     getReposDir: () => getReposDir(envConfig.session, homedir2()),
-    createInterval: (callback, ms) => setInterval(callback, ms),
+    createInterval: setInterval,
     clearInterval: (id) => clearInterval(id),
     auth: {
       createServer: createLocalServer,
@@ -8352,9 +8573,9 @@ function createAuthFileSystem(dependencies) {
     readFile: (path2) => dependencies.readFile(path2, "utf8"),
     writeFile: (path2, content) => dependencies.writeFile(path2, content, "utf8"),
     mkdir: (path2, options) => dependencies.mkdir(path2, options).then(() => {}),
-    readdir: (path2) => dependencies.readdir(path2),
-    chmod: (path2, mode) => dependencies.chmod(path2, mode),
-    rename: (oldPath, newPath) => dependencies.rename(oldPath, newPath)
+    readdir: dependencies.readdir.bind(dependencies),
+    chmod: dependencies.chmod.bind(dependencies),
+    rename: dependencies.rename.bind(dependencies)
   };
 }
 function createInitialState() {
@@ -8507,7 +8728,6 @@ function connectWebSocket(token, state, bucketDependencies, context, fileSystem,
   if (state.shuttingDown)
     return;
   const wsUrl = getWebSocketUrl(bucketDependencies.bucket);
-  let waitingForConnectionReady = false;
   let connectionReady = false;
   const processIncomingServerMessage = (event) => {
     let rawData;
@@ -8546,10 +8766,8 @@ function connectWebSocket(token, state, bucketDependencies, context, fileSystem,
     }
     if (message.type === "connection-ready") {
       connectionReady = true;
-      waitingForConnectionReady = false;
     } else if (message.type === "connection-rejected") {
       connectionReady = false;
-      waitingForConnectionReady = false;
     } else if (!connectionReady) {
       return;
     }
@@ -8568,7 +8786,6 @@ function connectWebSocket(token, state, bucketDependencies, context, fileSystem,
     });
   };
   const sendConnectionInit = async () => {
-    waitingForConnectionReady = true;
     let message;
     try {
       message = await bucketDependencies.buildConnectionInit();
@@ -8588,7 +8805,6 @@ function connectWebSocket(token, state, bucketDependencies, context, fileSystem,
       const messageText = error instanceof Error ? error.message : String(error);
       context.stderr(`Failed to send connection init: ${messageText}. Continuing without handshake.`);
       connectionReady = true;
-      waitingForConnectionReady = false;
     }
   };
   let ws;
@@ -8662,7 +8878,7 @@ function createMessageEffectDeps(dependencies) {
   } = dependencies;
   return {
     logMessage: (message, stream) => logMessage(state, context, useTUI, message, stream),
-    debugLog: (message) => log10(message),
+    debugLog: log10,
     syncUIWithRepoList: (repositories) => syncUIWithRepoList(state, repositories),
     handleRepositoryList: (repositories) => {
       const repoDeps = toRepositoryDependencies(bucketDependencies, fileSystem, state, forwardToolExecution);
@@ -9120,7 +9336,7 @@ Run \`dust bucket tool ${toolName}\` to see available operations.`);
 }
 
 // lib/cli/commands/lint-markdown.ts
-import { isAbsolute, join as join9, relative, sep } from "node:path";
+import { isAbsolute, join as join10, relative, sep } from "node:path";
 
 // lib/artifacts/principles.ts
 function extractLinksFromSection(content, sectionHeading) {
@@ -9940,7 +10156,7 @@ async function lintMarkdown(dependencies) {
   const violations = [];
   context.stdout("Validating directory structure...");
   violations.push(...await validateDirectoryStructure(dustPath, fileSystem));
-  const settingsPath = join9(dustPath, "config", "settings.json");
+  const settingsPath = join10(dustPath, "config", "settings.json");
   const settingsResult = await validateSettingsFile(fileSystem, settingsPath);
   if (settingsResult.didValidate) {
     context.stdout("Validating settings.json...");
@@ -10055,8 +10271,8 @@ async function runValidationCheck(dependencies, emitEvent, clock = Date.now) {
   const outputLines = [];
   const bufferedContext = {
     cwd: dependencies.context.cwd,
-    stdout: (msg) => outputLines.push(msg),
-    stderr: (msg) => outputLines.push(msg)
+    stdout: outputLines.push.bind(outputLines),
+    stderr: outputLines.push.bind(outputLines)
   };
   log11("running built-in check: dust lint");
   emitEvent?.({ type: "check-started", name: "lint .dust directory" });
@@ -10370,7 +10586,7 @@ async function init(dependencies) {
 import { basename as basename3, resolve as resolve4 } from "node:path";
 
 // lib/core-principles.ts
-import { join as join10, dirname as dirname5 } from "node:path";
+import { join as join11, dirname as dirname5 } from "node:path";
 import { fileURLToPath } from "node:url";
 import { existsSync, readdirSync, statSync as statSync2 } from "node:fs";
 import { readFile as readFile3 } from "node:fs/promises";
@@ -10449,7 +10665,7 @@ function locatePackagePrinciplesDir() {
   const thisFile = fileURLToPath(import.meta.url);
   const thisDir = dirname5(thisFile);
   const packageRoot = dirname5(thisDir);
-  const principlesDir = join10(packageRoot, ".dust", "principles");
+  const principlesDir = join11(packageRoot, ".dust", "principles");
   if (!existsSync(principlesDir)) {
     throw new Error(`Core principles directory not found at ${principlesDir}. ` + "Ensure the @joshski/dust package is properly installed.");
   }
@@ -10458,7 +10674,7 @@ function locatePackagePrinciplesDir() {
 async function readAllCorePrinciples() {
   const principlesDir = locatePackagePrinciplesDir();
   const packageRoot = dirname5(dirname5(principlesDir));
-  const dustPath = join10(packageRoot, ".dust");
+  const dustPath = join11(packageRoot, ".dust");
   const fileSystem = createReadableFileSystem();
   const files = readdirSync(principlesDir);
   const mdFiles = files.filter((f) => f.endsWith(".md"));
@@ -10854,8 +11070,9 @@ async function list(dependencies) {
 }
 
 // lib/loop/loop.ts
-import { existsSync as existsSync2 } from "node:fs";
+import { existsSync as existsSync2, writeFileSync as writeFileSync2, unlinkSync as unlinkSync2 } from "node:fs";
 import os3 from "node:os";
+import { join as join12 } from "node:path";
 
 // lib/loop/parse-args.ts
 var DEFAULT_MAX_ITERATIONS = 10;
@@ -10886,6 +11103,36 @@ async function sleepWithProgress(sleep, totalMs, writeInline, writeLine) {
 
 // lib/loop/loop.ts
 var log12 = createLogger("dust:loop");
+async function setupDockerProxies(dockerResult, loopDependencies, sessionId) {
+  const gitProxy = await createGitCredentialProxyServer({
+    spawn: loopDependencies.spawn,
+    userHome: process.env.DUST_USER_HOME || undefined
+  });
+  const apiProxy = await createClaudeApiProxyServer();
+  const claudeApiProxyUrl = `http://host.docker.internal:${apiProxy.port}`;
+  const settingsFilePath = join12(os3.tmpdir(), `dust-claude-settings-${sessionId}.json`);
+  const settingsContent = generateApiKeyHelperSettings(claudeApiProxyUrl);
+  writeFileSync2(settingsFilePath, settingsContent, "utf-8");
+  log12(`created settings file at ${settingsFilePath}`);
+  return {
+    dockerConfig: {
+      ...dockerResult.config,
+      gitProxyUrl: `http://host.docker.internal:${gitProxy.port}`,
+      claudeApiProxyUrl,
+      settingsFilePath
+    },
+    stopGitProxy: gitProxy.stop,
+    stopApiProxy: apiProxy.stop,
+    settingsFilePath
+  };
+}
+function resolveDockerDependencies(loopDependencies) {
+  return {
+    spawn: loopDependencies.dockerDeps?.spawn ?? loopDependencies.spawn,
+    homedir: loopDependencies.dockerDeps?.homedir ?? os3.homedir,
+    existsSync: loopDependencies.dockerDeps?.existsSync ?? existsSync2
+  };
+}
 async function runLoop(dependencies, loopDependencies) {
   enableFileLogs("loop");
   const { context, settings } = dependencies;
@@ -10917,34 +11164,20 @@ async function runLoop(dependencies, loopDependencies) {
   };
   const hooksInstalled = await manageGitHooks(dependencies);
   let dockerConfig;
-  const dockerDeps = {
-    spawn: loopDependencies.dockerDeps?.spawn ?? loopDependencies.spawn,
-    homedir: loopDependencies.dockerDeps?.homedir ?? os3.homedir,
-    existsSync: loopDependencies.dockerDeps?.existsSync ?? existsSync2
-  };
+  const dockerDeps = resolveDockerDependencies(loopDependencies);
   const dockerResult = await prepareDockerConfig(context.cwd, dockerDeps, onLoopEvent);
   if ("error" in dockerResult) {
     context.stderr(dockerResult.error);
     return { exitCode: 1 };
   }
-  let stopGitProxy;
-  let stopApiProxy;
+  let dockerProxies;
   if ("config" in dockerResult) {
     if (!process.env.CLAUDE_CODE_OAUTH_TOKEN) {
       context.stderr("Docker mode requires CLAUDE_CODE_OAUTH_TOKEN. Run `claude setup-token` and export the token.");
       return { exitCode: 1 };
     }
-    const gitProxy = await createGitCredentialProxyServer({
-      spawn: loopDependencies.spawn
-    });
-    stopGitProxy = gitProxy.stop;
-    const apiProxy = await createClaudeApiProxyServer();
-    stopApiProxy = apiProxy.stop;
-    dockerConfig = {
-      ...dockerResult.config,
-      gitProxyUrl: `http://host.docker.internal:${gitProxy.port}`,
-      claudeApiProxyUrl: `http://host.docker.internal:${apiProxy.port}`
-    };
+    dockerProxies = await setupDockerProxies(dockerResult, loopDependencies, sessionId);
+    dockerConfig = dockerProxies.dockerConfig;
   }
   log12(`starting loop, maxIterations=${maxIterations}, sessionId=${sessionId}`);
   onLoopEvent({ type: "loop.warning" });
@@ -10980,8 +11213,14 @@ async function runLoop(dependencies, loopDependencies) {
       });
     }
   }
-  stopGitProxy?.();
-  stopApiProxy?.();
+  dockerProxies?.stopGitProxy();
+  dockerProxies?.stopApiProxy();
+  if (dockerProxies?.settingsFilePath) {
+    try {
+      unlinkSync2(dockerProxies.settingsFilePath);
+      log12(`cleaned up settings file ${dockerProxies.settingsFilePath}`);
+    } catch {}
+  }
   log12(`loop ended after ${completedIterations} iterations`);
   onLoopEvent({ type: "loop.ended", maxIterations });
   return { exitCode: 0 };
@@ -11534,9 +11773,9 @@ function createFileSystem(primitives) {
       await primitives.mkdir(path2, options);
     },
     getFileCreationTime: (path2) => primitives.statSync(path2).birthtimeMs,
-    readdir: (path2) => primitives.readdir(path2),
-    chmod: (path2, mode) => primitives.chmod(path2, mode),
-    rename: (oldPath, newPath) => primitives.rename(oldPath, newPath)
+    readdir: primitives.readdir.bind(primitives),
+    chmod: primitives.chmod.bind(primitives),
+    rename: primitives.rename.bind(primitives)
   };
 }
 function createGlobScanner(readdirFn) {
@@ -11583,14 +11822,10 @@ async function wireEntry(fsPrimitives, processPrimitives, consolePrimitives, run
 // lib/cli/run.ts
 var envConfig = readEnvConfig(process.env);
 var writeEvent = createCommandEventWriter(process.env, {
-  fetch: (input, init2) => fetch(input, init2),
-  onError: (message) => {
-    console.error(message);
-  }
+  fetch,
+  onError: console.error.bind(console)
 });
-var emitEvent = writeEvent ? createEventEmitter((message) => {
-  writeEvent(message);
-}) : undefined;
+var emitEvent = writeEvent ? createEventEmitter(writeEvent) : undefined;
 await wireEntry(defaultFileSystemPrimitives, {
   argv: process.argv,
   cwd: () => process.cwd(),