@rallycry/conveyor-agent 10.3.0 → 10.4.0

package/runtime/entrypoint.sh

@@ -183,6 +183,13 @@ done
 # as the literal string "null", which then flows into git URLs and env vars.
 export CONVEYOR_TASK_TOKEN=$(echo "${BOOTSTRAP_JSON}" | jq -r '.sessionJwt // empty')
 export CONVEYOR_GITHUB_TOKEN=$(echo "${BOOTSTRAP_JSON}" | jq -r '.githubToken // empty')
+# gh CLI auth (baked into the base image). GH_TOKEN (not GITHUB_TOKEN — that
+# name leaks into too many third-party tools) points gh at the same role-scoped
+# installation token git uses. Caveat: installation tokens live ~1h and the
+# agent's refresh path updates the git remote URL, not this env — a long-lived
+# session's gh calls can 401 after expiry; agents should treat that as
+# "re-check via MCP tools", not an auth bug to debug.
+export GH_TOKEN="${CONVEYOR_GITHUB_TOKEN}"
 REPO_OWNER=$(echo "${BOOTSTRAP_JSON}" | jq -r '.gitPlan.repoOwner // empty')
 REPO_NAME=$(echo "${BOOTSTRAP_JSON}" | jq -r '.gitPlan.repoName // empty')
 BRANCH=$(echo "${BOOTSTRAP_JSON}" | jq -r '.gitPlan.branch // empty')
@@ -318,6 +325,14 @@ seed_claude_json() {
 # back to PROJECT_ID from the pod env.
 USER_HOME_MOUNT="/mnt/conveyor-users"
 USER_HOME_PROJECT_ID="${CONVEYOR_PROJECT_ID_FROM_BUNDLE:-${PROJECT_ID:-}}"
+
+# Bake steps that run as root while ENV HOME points at /home/conveyor can leave
+# root-owned $HOME entries (a uv install receipt in ~/.config once bricked every
+# pod boot fleet-wide); reclaim them before the symlink work below so a baked
+# ownership slip cannot EACCES the entrypoint under `set -e`. Runs before any
+# symlinks exist, so there is nothing to follow into the FUSE mount.
+sudo -n chown -R conveyor:conveyor /home/conveyor/.config /home/conveyor/.local 2>/dev/null || true
+
 if [ -n "${CONVEYOR_USER_ID}" ] && [ -n "${USER_HOME_PROJECT_ID}" ] && [ -d "${USER_HOME_MOUNT}" ]; then
   USER_HOME_ROOT="${USER_HOME_MOUNT}/users/${CONVEYOR_USER_ID}/${USER_HOME_PROJECT_ID}"
   echo "[pool] Linking Claude state to ${USER_HOME_ROOT}"
@@ -419,8 +434,69 @@ bind_graphify_bundle() {
   echo "[pool] Bound graphify bundle '${CONVEYOR_GRAPHIFY_SLUG}' into ${target_dir}"
 }
 
+# ── Link shared Grimoire skills into the repo's project skill dir ──
+# The prebake links grimoire skills into the BAKED image's ~/.claude/skills,
+# but the user-home wiring above replaces /home/conveyor/.claude with the
+# per-user GCS mount on every mounted pod boot — wiping those links before any
+# agent runs (observed fleet-wide 2026-07-10: pods saw only repo-tracked
+# skills, none of the shared rc-* set). Link repo-locally instead: Claude
+# loads project skills from <workspace>/.claude/skills regardless of where
+# $HOME points, the links are pod-local (no writes to the shared mount, no
+# cross-pod races), and .gitignore covers them so `git status` stays clean.
+# Runs inside mark_git_ready — after checkout is final, before the agent may
+# spawn Claude — alongside the graphify bundle bind. Both helpers are
+# best-effort: a grimoire failure must never block the git-ready gate.
+ensure_grimoire_submodule() {
+  local workspace="${CONVEYOR_WORKSPACE:-/workspaces/repo}"
+  [ -f "${workspace}/.gitmodules" ] || return 0
+  git -C "${workspace}" config --file .gitmodules --get-regexp 'submodule\..*\.path' 2>/dev/null \
+    | grep -q '\.claude/grimoire$' || return 0
+  # Already materialized (pod-image bake ran conveyor-prebake successfully).
+  [ -d "${workspace}/.claude/grimoire/skills" ] && return 0
+  if [ -z "${CONVEYOR_GITHUB_TOKEN:-}" ]; then
+    echo "[pool] WARN: grimoire submodule absent and no token to fetch it"
+    return 0
+  fi
+  # insteadOf injects the installation token for the submodule's https URL the
+  # same way sync_task_branch_to_repo authenticates the main repo remote.
+  if _grim_out=$(git -C "${workspace}" \
+      -c url."https://x-access-token:${CONVEYOR_GITHUB_TOKEN}@github.com/".insteadOf="https://github.com/" \
+      submodule update --init .claude/grimoire 2>&1); then
+    echo "[pool] Initialized grimoire submodule"
+  else
+    echo "[pool] WARN: grimoire submodule init failed (baked pods may lack rc-* skills): ${_grim_out}"
+  fi
+  return 0
+}
+
+link_grimoire_skills() {
+  local workspace="${CONVEYOR_WORKSPACE:-/workspaces/repo}"
+  local source_dir="${workspace}/.claude/grimoire/skills"
+  local target_dir="${workspace}/.claude/skills"
+  [ -d "${source_dir}" ] || return 0
+  if ! mkdir -p "${target_dir}" 2>/dev/null; then
+    echo "[pool] WARN: unable to create ${target_dir}; skipping grimoire skill links"
+    return 0
+  fi
+  local skill_dir name linked=0
+  for skill_dir in "${source_dir}"/*/; do
+    [ -d "${skill_dir}" ] || continue
+    name="$(basename "${skill_dir}")"
+    # Never clobber a real (repo-tracked) skill dir with a link.
+    if [ -e "${target_dir}/${name}" ] && [ ! -L "${target_dir}/${name}" ]; then
+      echo "[pool] WARN: ${target_dir}/${name} exists and is not a symlink; skipping"
+      continue
+    fi
+    ln -sfn "../grimoire/skills/${name}" "${target_dir}/${name}" 2>/dev/null && linked=$((linked + 1))
+  done
+  echo "[pool] Linked ${linked} grimoire skills into ${target_dir}"
+  return 0
+}
+
 mark_git_ready() {
   bind_graphify_bundle
+  ensure_grimoire_submodule
+  link_grimoire_skills
   : > "$GIT_READY_MARKER"
 }