@rallycry/conveyor-agent 10.0.5 → 10.1.0

package/runtime/entrypoint.sh

@@ -270,6 +270,34 @@ CONVEYOR_USER_ID="${CONVEYOR_USER_ID:-}"
 CONVEYOR_PROJECT_ID_FROM_BUNDLE="${CONVEYOR_PROJECT_ID:-${PROJECT_ID:-}}"
 export CONVEYOR_USER_ID
 
+# ── Seed Claude Code's first-run gates ──
+# Pre-answer every interactive gate the CLI shows on a fresh (or partially
+# initialized) config: the onboarding wizard (theme picker), the
+# bypass-permissions warning, and the folder-trust dialog for the repo
+# workspace. Any one of these parks a headless TUI forever — seen live
+# 2026-07-02 as code reviews stuck at "Is this a project you trust?" until the
+# server's cap burned the attempt. conveyor-agent also seeds the same keys before
+# each spawn (ensureClaudeOnboarding), but this shell seed is version-independent
+# (pods can run older baked agents) and lands before the CLI's first read — and
+# it also covers an interactive `claude` opened over an SSH tunnel, which the
+# agent seed never runs for. Merge via jq, never clobber: CLI-owned keys (cache
+# keys, firstStartTime, other projects' trust entries) survive; a missing or
+# corrupt file becomes a fresh seed — Claude Code treats a 0-byte/unparseable
+# file as fatal ("Unexpected end of JSON input"), so replacing is a repair. Theme
+# only seeds fresh configs (a user-picked theme is never overridden). Every step
+# is rescued: config seeding must never kill the entrypoint under `set -eo pipefail`.
+seed_claude_json() {
+  SEED_TARGET="$1"
+  SEED_GATES='{"hasCompletedOnboarding":true,"bypassPermissionsModeAccepted":true,"projects":{"/workspaces/repo":{"hasTrustDialogAccepted":true}}}'
+  if [ -f "${SEED_TARGET}" ] && jq -e . "${SEED_TARGET}" >/dev/null 2>&1; then
+    if SEED_MERGED="$(jq -c --argjson gates "${SEED_GATES}" '. * $gates' "${SEED_TARGET}" 2>/dev/null)" && [ -n "${SEED_MERGED}" ]; then
+      printf '%s' "${SEED_MERGED}" > "${SEED_TARGET}" 2>/dev/null || true
+    fi
+  else
+    printf '%s' "${SEED_GATES}" | jq -c '. + {theme:"dark"}' > "${SEED_TARGET}" 2>/dev/null || true
+  fi
+}
+
 # ── Wire per-user Claude state from the GCS FUSE mount ──
 # When the pod has /mnt/conveyor-users mounted (GCS FUSE CSI), symlink
 # ~/.claude, ~/.claude.json, and ~/.config/claude to the user's subdir so
@@ -282,29 +310,7 @@ if [ -n "${CONVEYOR_USER_ID}" ] && [ -n "${USER_HOME_PROJECT_ID}" ] && [ -d "${U
   USER_HOME_ROOT="${USER_HOME_MOUNT}/users/${CONVEYOR_USER_ID}/${USER_HOME_PROJECT_ID}"
   echo "[pool] Linking Claude state to ${USER_HOME_ROOT}"
   mkdir -p "${USER_HOME_ROOT}/.claude" "${USER_HOME_ROOT}/.config/claude" 2>/dev/null || true
-  # Seed .claude.json on first use. Claude Code treats a 0-byte file as
-  # corrupted ("Unexpected end of JSON input") and exits code 1, killing the
-  # very first query on any fresh user+project mount. We pre-complete onboarding
-  # and pick a default theme so the spawned Claude Code TUI doesn't stop at the
-  # first-run theme picker / login. Only seed when the file is missing/empty or a
-  # bare "{}" placeholder — never overwrite a real config carried over via the
-  # GCS-FUSE user-home mount from a prior pod session.
-  CLAUDE_JSON="${USER_HOME_ROOT}/.claude.json"
-  # Read defensively: on a first-time user+project mount the file does not
-  # exist yet. `< "${CLAUDE_JSON}"` on a missing file is a SHELL-level
-  # redirection error (the `2>/dev/null` only silences tr, not bash), which
-  # under `set -eo pipefail` aborts the whole entrypoint with exit 1 — the
-  # agent container then dies seconds after start and the pod is reaped
-  # ("deleted externally"). Guard on existence and rescue any read error so a
-  # missing/unreadable file falls through to the seed below instead of crashing.
-  if [ -f "${CLAUDE_JSON}" ]; then
-    CLAUDE_JSON_CURRENT="$(tr -d '[:space:]' < "${CLAUDE_JSON}" 2>/dev/null || true)"
-  else
-    CLAUDE_JSON_CURRENT=""
-  fi
-  if [ -z "${CLAUDE_JSON_CURRENT}" ] || [ "${CLAUDE_JSON_CURRENT}" = "{}" ]; then
-    echo '{"hasCompletedOnboarding":true,"theme":"dark"}' > "${CLAUDE_JSON}" 2>/dev/null || true
-  fi
+  seed_claude_json "${USER_HOME_ROOT}/.claude.json"
 
   # Replace any image defaults with live symlinks into the mount.
   rm -rf /home/conveyor/.claude /home/conveyor/.claude.json /home/conveyor/.config/claude 2>/dev/null || true
@@ -314,6 +320,9 @@ if [ -n "${CONVEYOR_USER_ID}" ] && [ -n "${USER_HOME_PROJECT_ID}" ] && [ -d "${U
   ln -sfn "${USER_HOME_ROOT}/.config/claude" /home/conveyor/.config/claude
 else
   echo "[pool] Skipping user-home symlink (userId='${CONVEYOR_USER_ID}', projectId='${USER_HOME_PROJECT_ID}', mount present: $([ -d "${USER_HOME_MOUNT}" ] && echo yes || echo no))"
+  # No persistent home — the CLI reads the pod-local config; seed it there so
+  # non-FUSE pods get the same first-run gate suppression as the mounted path.
+  seed_claude_json /home/conveyor/.claude.json
 fi
 
 # ═══════════════════════════════════════════════════════════════════════════
@@ -343,6 +352,24 @@ fi
 GIT_READY_MARKER="/workspaces/.conveyor-git-ready"
 GIT_FAILED_MARKER="/workspaces/.conveyor-git-failed"
 
+reset_tracked_repo_changes_before_assignment_checkout() {
+  # The baked/pooled repo is not user-owned until this git gate succeeds. Reset
+  # stale tracked image-generated dirt so assignment checkout can move to the
+  # requested branch/ref instead of being blocked by files like dependency
+  # stamps. Do not `git clean`: untracked prebake artifacts may be intentional.
+  # The assignment checkouts additionally pass -f: an UNTRACKED bake artifact
+  # can collide with a path the TARGET ref tracks (e.g. a dependency stamp
+  # committed on an older PR branch), which this reset cannot clear — checkout
+  # then refuses with "untracked working tree files would be overwritten".
+  # Forcing is safe here for the same not-user-owned reason.
+  if ! _reset_out=$(git -C repo reset --hard HEAD 2>&1); then
+    echo "[pool] ERROR: failed to clean tracked repo changes before checkout: ${_reset_out}" >&2
+    printf '%s' "pre-checkout reset failed" > "$GIT_FAILED_MARKER"
+    return 1
+  fi
+  return 0
+}
+
 # Shared by both the pod-image branch and the repo-present-non-pod-image branch
 # of prepare_workspace_git: refresh the remote token, fetch the base branch,
 # fetch/checkout the task branch (creating it from base if it doesn't exist on
@@ -365,6 +392,10 @@ sync_task_branch_to_repo() {
     echo "[pool] WARN: fetch origin/${DEV_BRANCH} failed: ${_fetch_dev_out}" >&2
   fi
 
+  if ! reset_tracked_repo_changes_before_assignment_checkout; then
+    return 1
+  fi
+
   if [ -n "${CHECKOUT_REF}" ]; then
     echo "[pool] Fetching checkout ref ${CHECKOUT_REF} for review branch ${BRANCH}..."
     if ! _fetch_checkout_out=$(git -C repo fetch origin "+${CHECKOUT_REF}:refs/remotes/origin/pr-checkout" 2>&1); then
@@ -372,7 +403,7 @@ sync_task_branch_to_repo() {
       printf '%s' "fetch checkout ref ${CHECKOUT_REF} failed" > "$GIT_FAILED_MARKER"
       return 1
     fi
-    if ! _checkout_out=$(git -C repo checkout -B "${BRANCH}" "refs/remotes/origin/pr-checkout" 2>&1); then
+    if ! _checkout_out=$(git -C repo checkout -f -B "${BRANCH}" "refs/remotes/origin/pr-checkout" 2>&1); then
       echo "[pool] ERROR: Repo checkout of ${CHECKOUT_REF} failed: ${_checkout_out}" >&2
       printf '%s' "checkout of ${CHECKOUT_REF} failed" > "$GIT_FAILED_MARKER"
       return 1
@@ -387,7 +418,7 @@ sync_task_branch_to_repo() {
       if echo "${_fetch_out}" | grep -q "couldn't find remote ref"; then
         echo "[pool] Branch missing on origin — creating from base '${DEV_BRANCH}'"
         # Create the branch locally from the base branch
-        if ! _create_out=$(git -C repo checkout -B "${BRANCH}" "origin/${DEV_BRANCH}" 2>&1); then
+        if ! _create_out=$(git -C repo checkout -f -B "${BRANCH}" "origin/${DEV_BRANCH}" 2>&1); then
           echo "[pool] ERROR: Failed to create branch '${BRANCH}' from '${DEV_BRANCH}': ${_create_out}" >&2
           printf '%s' "create branch ${BRANCH} from ${DEV_BRANCH} failed" > "$GIT_FAILED_MARKER"
           return 1
@@ -409,7 +440,7 @@ sync_task_branch_to_repo() {
     # Use `checkout -B` to create or reset the local branch tracking origin.
     # This leaves HEAD attached to a real branch (not detached) so `git status`,
     # `git push`, and any tool that keys off branch state work correctly.
-    if ! _checkout_out=$(git -C repo checkout -B "${BRANCH}" "origin/${BRANCH}" 2>&1); then
+    if ! _checkout_out=$(git -C repo checkout -f -B "${BRANCH}" "origin/${BRANCH}" 2>&1); then
       echo "[pool] ERROR: Repo checkout of ${BRANCH} failed: ${_checkout_out}" >&2
       printf '%s' "checkout of ${BRANCH} failed" > "$GIT_FAILED_MARKER"
       return 1
@@ -482,7 +513,7 @@ prepare_workspace_git() {
         printf '%s' "post-assignment fetch of ${CHECKOUT_REF} failed" > "$GIT_FAILED_MARKER"
         return 1
       fi
-      if ! _checkout_out=$(git -C repo checkout -B "${BRANCH}" "refs/remotes/origin/pr-checkout" 2>&1); then
+      if ! _checkout_out=$(git -C repo checkout -f -B "${BRANCH}" "refs/remotes/origin/pr-checkout" 2>&1); then
         echo "[pool] ERROR: post-assignment checkout of ${CHECKOUT_REF} failed: ${_checkout_out}" >&2
         printf '%s' "post-assignment checkout of ${CHECKOUT_REF} failed" > "$GIT_FAILED_MARKER"
         return 1