@rallycry/conveyor-agent 11.0.47 → 11.0.49

package/dist/{boot-ZPXDDZDF.js → boot-GD5XMLPS.js}

@@ -1,6 +1,6 @@
 import {
   startWorkbenchServer
-} from "./chunk-F7XHSNU7.js";
+} from "./chunk-ATYCG6MT.js";
 import {
   TOMBSTONE_MESSAGE,
   isLegacyEntrypointLaunch
@@ -12,7 +12,7 @@ import {
   refreshSkillsAfterCheckout,
   runPreReadyBinds
 } from "./chunk-V5WR2F2P.js";
-import "./chunk-EKTPDG3G.js";
+import "./chunk-SXZS2R52.js";
 import {
   GitPrepJob,
   defaultGit,
@@ -491,11 +491,15 @@ async function superviseRunner(opts) {
 // src/boot/user-home.ts
 import {
   chmodSync,
+  closeSync,
   copyFileSync,
   existsSync,
+  fsyncSync,
   lstatSync,
   mkdirSync,
+  openSync,
   readFileSync,
+  readlinkSync,
   readdirSync,
   rmSync,
   statSync as statSync2,
@@ -645,7 +649,10 @@ function seedClaudeJson(targetPath) {
     let merged = config ? deepMerge(config, SEED_GATES) : { ...SEED_GATES, theme: "dark" };
     const cache = Array.isArray(merged.additionalModelOptionsCache) ? merged.additionalModelOptionsCache : [];
     if (!hasFableEntry(cache)) {
-      merged = { ...merged, additionalModelOptionsCache: [...cache, SEED_FABLE_OPTION] };
+      merged = {
+        ...merged,
+        additionalModelOptionsCache: [...cache, SEED_FABLE_OPTION]
+      };
     }
     writeFileSync2(targetPath, JSON.stringify(merged));
   } catch {
@@ -787,12 +794,60 @@ function wireUserHome(opts) {
     "mkdir agent scratch dir",
     () => mkdirSync(opts.scratchDir ?? "/tmp/claude-cmd", { recursive: true })
   );
+  if (opts.required && (!userId || !projectId || !isDir(userHomeMount))) {
+    throw new Error("Required persistent user home is unavailable or missing claim identity");
+  }
   if (userId && projectId && isDir(userHomeMount)) {
-    return wireMountedUserHome({ home, userHomeMount, userId, projectId, sharedDir, log });
+    if (opts.required) assertHomeWritable(join3(userHomeMount, "users", userId, projectId));
+    const repair = wireMountedUserHome({
+      home,
+      userHomeMount,
+      userId,
+      projectId,
+      sharedDir,
+      log
+    });
+    if (opts.required) assertHomeLinks(opts, userId, projectId);
+    return repair;
   }
   wireNoMountUserHome({ home, sharedDir, log });
   return Promise.resolve();
 }
+function assertHomeWritable(root) {
+  mkdirSync(root, { recursive: true });
+  const probe = join3(root, `.home-ready-${process.pid}-${crypto.randomUUID()}`);
+  const fd = openSync(probe, "wx", 384);
+  try {
+    fsyncSync(fd);
+  } finally {
+    closeSync(fd);
+    rmSync(probe);
+  }
+}
+function assertHomeLinks(opts, userId, projectId) {
+  const root = join3(opts.userHomeMount, "users", userId, projectId);
+  for (const relative of [
+    ".claude",
+    ".config/claude",
+    ".conveyor-codex",
+    ".local/share/opencode",
+    ".config/opencode"
+  ]) {
+    const link = join3(opts.home, relative);
+    if (!lstatSync(link).isSymbolicLink() || readlinkSync(link) !== join3(root, relative)) {
+      throw new Error(`Required persistent user home link ${relative} was not wired`);
+    }
+  }
+  const memory = join3(root, ".claude", "projects", AGENT_MEMORY_PROJECT_DIR, "memory");
+  if (readlinkSync(memory) !== join3(opts.userHomeMount, "users", "_shared", "memory", projectId)) {
+    throw new Error("Required persistent shared memory was not wired");
+  }
+  const credentials = join3(root, ".claude", ".credentials.json");
+  const podLocal = opts.sharedDir ? join3(opts.sharedDir, "claude-credentials.pod.json") : join3(opts.home, ".claude-credentials.pod.json");
+  if (readlinkSync(credentials) !== podLocal || !isRegularFile(join3(opts.home, ".claude.json"))) {
+    throw new Error("Required persistent home must keep credentials and CLI config pod-local");
+  }
+}
 var RECLAIM_FIND_TIMEOUT_MS = 1e4;
 async function reclaimHomeOwnership(home, exec, log) {
   for (const dir of [join3(home, ".config"), join3(home, ".local")]) {
@@ -824,7 +879,7 @@ async function reclaimHomeOwnership(home, exec, log) {
 }
 
 // src/boot/sshd.ts
-import { chmodSync as chmodSync2, closeSync, copyFileSync as copyFileSync2, existsSync as existsSync2, mkdirSync as mkdirSync2, openSync } from "fs";
+import { chmodSync as chmodSync2, closeSync as closeSync2, copyFileSync as copyFileSync2, existsSync as existsSync2, mkdirSync as mkdirSync2, openSync as openSync2 } from "fs";
 import { join as join4 } from "path";
 function persistedAuthorizedKeys() {
   return join4(
@@ -843,7 +898,7 @@ async function startWorkspaceSshd(exec, log, port = process.env.CONVEYOR_WORKSPA
     if (existsSync2(persisted)) {
       copyFileSync2(persisted, authorizedKeys);
     } else if (!existsSync2(authorizedKeys)) {
-      closeSync(openSync(authorizedKeys, "a"));
+      closeSync2(openSync2(authorizedKeys, "a"));
     }
     chmodSync2(authorizedKeys, 384);
   } catch (err) {
@@ -919,6 +974,7 @@ function defaultWorkbenchBootDeps() {
       void wireUserHome({
         home: HOME_DIR,
         userHomeMount: USER_HOME_MOUNT,
+        required: process.env.CONVEYOR_USER_HOME_REQUIRED === "1",
         userId: ctx.childEnv?.CONVEYOR_USER_ID,
         projectId: ctx.childEnv?.CONVEYOR_PROJECT_ID ?? ctx.childEnv?.PROJECT_ID,
         sharedDir: process.env.CONVEYOR_SHARED_DIR,
@@ -944,7 +1000,10 @@ function warnErr(ctx, label) {
   };
 }
 async function runWorkbenchBoot(ctx, overrides = {}) {
-  const deps = { ...defaultWorkbenchBootDeps(), ...overrides };
+  const deps = {
+    ...defaultWorkbenchBootDeps(),
+    ...overrides
+  };
   const bundle = await deps.pollBundle(ctx);
   if (!bundle) {
     ctx.log.info("[boot] standby poll aborted \u2014 parking for shutdown");
@@ -952,6 +1011,8 @@ async function runWorkbenchBoot(ctx, overrides = {}) {
   }
   ctx.bundle = bundle;
   ctx.childEnv = deps.unpack(ctx, bundle);
+  const requiredHome = process.env.CONVEYOR_USER_HOME_REQUIRED === "1";
+  if (requiredHome) deps.wireHome(ctx);
   const job = new GitPrepJob(deps.gitPrepDeps(ctx, bundle), {
     // Order pinned by the old entrypoint-grimoire test: binds BEFORE the
     // ready flip (Claude must not spawn before skills exist), references after.
@@ -978,10 +1039,12 @@ async function runWorkbenchBoot(ctx, overrides = {}) {
     warnErr(ctx, "ensureWorkspaceDir")(err);
   }
   job.start();
-  try {
-    deps.wireHome(ctx);
-  } catch (err) {
-    warnErr(ctx, "wireUserHome")(err);
+  if (!requiredHome) {
+    try {
+      deps.wireHome(ctx);
+    } catch (err) {
+      warnErr(ctx, "wireUserHome")(err);
+    }
   }
   void deps.startSshd(ctx).catch(warnErr(ctx, "startWorkspaceSshd"));
   void deps.reclaimOwnership(ctx).catch(warnErr(ctx, "reclaimHomeOwnership"));
@@ -1079,6 +1142,7 @@ function agentBootSteps(deps = defaultBootDeps(), signal = new AbortController()
           void wireUserHome({
             home: HOME_DIR2,
             userHomeMount: USER_HOME_MOUNT2,
+            required: process.env.CONVEYOR_USER_HOME_REQUIRED === "1",
             userId: ctx.childEnv?.CONVEYOR_USER_ID,
             projectId: ctx.childEnv?.CONVEYOR_PROJECT_ID ?? ctx.childEnv?.PROJECT_ID,
             sharedDir: process.env.CONVEYOR_SHARED_DIR,

package/dist/{chunk-F7XHSNU7.js → chunk-ATYCG6MT.js}

@@ -1,6 +1,6 @@
 import {
   loadPtySpawn
-} from "./chunk-EKTPDG3G.js";
+} from "./chunk-SXZS2R52.js";
 import {
   terminateProcessGroup
 } from "./chunk-W4LZ7R6Z.js";

package/dist/{chunk-4A6GCJGG.js → chunk-K35YJK2U.js}

@@ -8,7 +8,7 @@ import {
   readWorkspaceBytes,
   statWorkspacePath,
   workspacePathExists
-} from "./chunk-KXB55NJP.js";
+} from "./chunk-O3MXZHIS.js";
 import {
   reportBootMilestone
 } from "./chunk-VIUZS7V4.js";

package/dist/{chunk-KXB55NJP.js → chunk-O3MXZHIS.js}

@@ -1371,7 +1371,7 @@ ${q.question}${q.options.length ? "\n" + q.options.map((o) => `- ${o.label}: ${o
   }
 };
 
-// ../shared/dist/chunk-DXAS5XD4.js
+// ../shared/dist/chunk-DUZLPI2K.js
 import { z } from "zod";
 import { z as z2 } from "zod";
 var DEFAULT_SONNET_MODEL = "claude-sonnet-5-5";
@@ -1476,7 +1476,10 @@ var actionsPrebakeRegistrySchema = z.string().trim().min(1).regex(
 function uniqueSortedArray(item, minimum = 0) {
   return z.array(item).min(minimum).superRefine((values, ctx) => {
     if (new Set(values).size !== values.length) {
-      ctx.addIssue({ code: z.ZodIssueCode.custom, message: "Duplicate values are not allowed" });
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        message: "Duplicate values are not allowed"
+      });
     }
   }).transform((values) => [...values].sort());
 }
@@ -2627,6 +2630,13 @@ var ListProjectTasksRequestSchema = z7.object({
 }).refine((p) => !(p.unassigned && p.assigneeId), {
   message: "Pass either assigneeId or unassigned, not both"
 });
+var ListCardStatesRequestSchema = z7.object({
+  projectId: z7.string(),
+  statuses: z7.array(z7.string()).min(1).max(32),
+  types: z7.array(z7.string()).optional(),
+  cursor: z7.string().nullable().optional(),
+  limit: z7.number().int().positive().optional().default(500)
+});
 var GetProjectTaskRequestSchema = z7.object({
   projectId: z7.string(),
   taskId: z7.string()
@@ -3639,6 +3649,15 @@ function formatEvaluateQuestionsResult(res) {
   );
   return JSON.stringify({ model: res.model, results });
 }
+function subProjectScopePaths(subProject) {
+  return [
+    ...new Set(
+      [subProject.rootPath, ...subProject.additionalAllowedPaths ?? []].filter(
+        (path) => !!path
+      )
+    )
+  ];
+}
 var MEETING_CHECKLIST_TITLE_MAX = 300;
 var MEETING_TRANSCRIPT_MAX_CHARS = 2e6;
 var MEETING_TITLE_MAX = 200;
@@ -5346,6 +5365,7 @@ export {
   TAG_REASON_MAX,
   CRITICAL_AUTOMATED_SOURCES,
   formatEvaluateQuestionsResult,
+  subProjectScopePaths,
   AGENT_STATUS_REASON_USER_QUESTION,
   TASK_CHAT_HISTORY_LIMIT,
   PM_CHAT_HISTORY_LIMIT,