agl 40.5.0 → 40.6.0

package/changelog.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## 2026-10-25 - 40.6.0
+
+### Features
+
+- Serve Claude Code in containers through a confined route of the inference proxy (AGL-882). The proxy also listens on a Unix socket, alone in a private directory of its own (`agl-proxy-confined/proxy.sock` beside its control socket, 0700 and 0600, the proxy user's alone), which serves the Claude pool's three endpoints Claude Code uses -- `GET /anthropic/v1/models`, `POST /anthropic/v1/messages` and `POST /anthropic/v1/messages/count_tokens` -- exactly as the loopback listener serves them, and refuses every other path, method and pool with 404 before anything is read or routed. It accepts confined runs' credentials alone (any other credential, the loopback clients' and leases' included, is unknown there: 401), and a confined run's credential is unknown on the loopback listener. A confined run's credential is issued for one container run on the control socket (`agl.proxy.confined`): a lease of the Claude pool, Claude accounts first and then the Anthropic API keys, whose sessions are the client `confined`'s, so its requests are placed, moved and counted like any other Claude client's. It lives as long as its holder's control connection, survives a proxy restart like a lease (the proxy keeps only its SHA-256 digest, with the new lease field `route: 'confined'`, and its holder takes it back), and `agl.proxy.confined.end` ends it at once; the proxy then closes the holder's connection with one last line saying why (`{"ended": …}`), which the holder reports instead of taking the credential back. `agl proxy confined run -- docker run …` takes a run's credential, adds the listener's directory as a read-only mount at `/run/agl-proxy` and Claude Code's settings right after `docker run` (`ANTHROPIC_UNIX_SOCKET=/run/agl-proxy/proxy.sock`, `ANTHROPIC_BASE_URL=http://localhost/anthropic`, `ANTHROPIC_AUTH_TOKEN`, model discovery on and nonessential traffic off), each passed by name, drops every variable that would give Claude Code another login or route from the environment `docker` runs with, prints the run's id, exits with the container's status and ends the credential when the container exits; a credential the operator ended (`agl proxy confined end <run id>`) or the proxy no longer hands back stops the container and ends the run with the reason. Claude Code sends its API requests through the socket itself (`ANTHROPIC_UNIX_SOCKET`, verified with 2.1.288), so no relay runs in the container. The socket is the proxy user's (0600): the container runs as that uid, or as root under rootless Docker; root of a rootful daemon also connects while it keeps Docker's default capabilities. `agl proxy status` names the confined listener and lists the runs (`confinedSocketPath`, `confinedRuns`). `test/e2e/e2e.proxyconfined.node.ts` runs Claude Code in a container without a network through the socket; it skips without Docker or the `ubuntu:24.04` image. Downgrade: an earlier proxy refuses to start while its store keeps a confined run's credential; let every confined run end first, or start this release once with none going and wait out the 60-second reclaim window.
+
+### Fixes
+
+- A fleet Claude worker keeps its verified MCP ticket identity when Claude Code continues its job in a new process and across controller restarts (AGL-840). Its caller launch was proved against one process of its background job and held only in the controller's memory: once Claude Code retired the idle process and started a new one for the same job (when someone wrote to the job in Claude Code), or the controller restarted, every MCP ticket write was refused with `TICKET_IDENTITY_REQUIRED` until AGL itself woke the worker again, and the controller logged nothing. A launch now belongs to its job: the controller keeps its binding in the store (new collection `agl_worker_caller_bindings`, one record per worker with digests of the launch id and generation, the job and session ids, the revision, the proved process and the approved bridge command; never a credential), and a bridge under another process, or one that outlived a restart, is proved again at its next call from a fresh Claude inventory, one read at a time: only the worker's session as the same job, in exactly the bridge's parent process, running the approved Claude Code executable, with the bridge its direct child on the recorded command. Any other process stays refused, and a refused process image is not proved again at every call. A job that settled before the fleet bound it keeps its launch instead of losing it. The launch is revoked for good when the worker is stopped or archived, launched again, or the inventory shows its session as another job or the fleet no longer gives the job to the worker. An upgrade moves each bridge in place onto the new build (same PID, a new image from the new install's path); it keeps the worker's identity when it runs the command recorded with the launch or the one the restarted controller resolves itself from its configured `agl` MCP entry (never one the bridge names), and the new command is kept with the binding. A controller that stops now closes fleet admission first and lets running worker jobs settle (at most ten seconds, then they are aborted) before it removes the caller hooks, so a stop or archive during shutdown is refused by the fleet as closing instead of failing on missing hooks. Every reason an enrollment stays unverified is written once to the controller log, with the worker and its session but never the launch id or a credential. Codex workers are unchanged: they are bound again before each dispatch. Downgrade: 40.5.1 starts with the new collection present and leaves it alone; a worker archived or launched again under the older release leaves its record behind, which this release refuses at the first enrollment that presents it (the fleet no longer gives that job to the worker) or replaces at the worker's next launch. Controller protocol stays 45.
+
+## 2026-10-25 - 40.5.1
+
+### Fixes
+
+- A Claude sign-in is no longer held for its fifteen minutes by Claude Code sessions whose working directory was deleted under them (AGL-836). The accounts service could not resolve such a process's working directory, so it left the process's home and credential store unknown as well, and a sign-in waits while any process may run on its home: the login Claude Code wrote was never added, and the sign-in ended saying no login had arrived. A home or store a process names by an absolute path is now resolved without its working directory; one named by a relative path stays unknown, and custody and the usage read still refuse a process on their home whose working directory they cannot read. A sign-in also no longer waits for an unknown process that started before its home was made (by more than five seconds, the process table's precision), since it cannot name a home whose name was random until then; container homes keep the strict rule. Process start times are now read from the process table in UTC, so on a host outside UTC a process started in the repeated hour after a daylight-saving change is no longer dated an hour early (which would have let such a process through this rule); the accounts service's check of its managed Codex app-server reads them the same way, and refuses starts and account changes when the process holding the run's socket has a start it cannot read, instead of treating that process as gone. A sign-in that is held names the processes holding it (`heldBy`, shown on the Accounts screen and by `authswitch account add claude`), and one still held when it expires imports nothing and says that a login arrived and which processes held it. A client of this release names an accounts service that answers a sign-in without `heldBy` outdated, so the service must be restarted onto this release. Controller protocol 45.
+
 ## 2026-10-23 - 40.5.0
 
 ### Features