codebay 0.5.0 → 0.6.0

package/src/container-injections/attention-hooks.ts

@@ -1,5 +1,10 @@
 import { PORT } from '../lib/config.server.ts';
-import { checkPresence, execInContainer } from '../lib/exec.server.ts';
+import { writeContainerFile } from '../lib/container-files.server.ts';
+import {
+	claudeConfigFile,
+	mergeClaudeSettings,
+	readClaudeSettings
+} from '../lib/claude-settings.server.ts';
 import type { ContainerTarget, Injection } from '../lib/injections.server.ts';
 
 function bridgeUrl(): string {
@@ -40,50 +45,32 @@ function hookFor(id: string, state: 'done' | 'waiting' | 'busy') {
 }
 
 /** Carries no token — that lives in the mode-600 header file `writeBridgeHeader` stages. */
-export function attentionHookSettings(id: string): string {
-	const settings = {
+export function attentionHookSettings(id: string): Record<string, unknown> {
+	return {
 		hooks: {
 			Stop: hookFor(id, 'done'),
 			Notification: hookFor(id, 'waiting'),
 			UserPromptSubmit: hookFor(id, 'busy')
 		}
 	};
-	return JSON.stringify(settings, null, 2);
 }
 
 /** Stored as a whole header line so curl can consume the file directly with `-H @`. */
-async function writeBridgeHeader(
+function writeBridgeHeader(
 	target: ContainerTarget,
 	token: string
 ): Promise<{ ok: boolean; error?: string }> {
-	const script =
-		'h=$(eval echo ~$(id -un)); d="${CLAUDE_CONFIG_DIR:-$h/.claude}"; mkdir -p "$d"; ' +
-		'f="$d/.bridge-header"; printf \'X-Bridge-Token: %s\\n\' "$CODEBAY_STDIN" > "$f"; chmod 600 "$f"';
-	const res = await execInContainer(target, { script, stdin: token });
-	return res.ok ? { ok: true } : { ok: false, error: res.error };
-}
-
-/** Merging rather than overwriting is what lets the settings.json injections compose in any order. */
-export function mergeClaudeSettingsScript(): string {
-	return (
-		'h=$(eval echo ~$(id -un)); d="${CLAUDE_CONFIG_DIR:-$h/.claude}"; mkdir -p "$d"; ' +
-		'f="$d/settings.json"; new="$CODEBAY_STDIN"; ' +
-		'if command -v jq >/dev/null 2>&1 && [ -s "$f" ] && ' +
-		'merged=$(printf \'%s\' "$new" | jq -s \'.[0] * .[1]\' "$f" - 2>/dev/null); then ' +
-		'printf \'%s\' "$merged" > "$f"; else printf \'%s\' "$new" > "$f"; fi; ' +
-		'chmod 644 "$f"'
+	return writeContainerFile(
+		target,
+		claudeConfigFile('.bridge-header', '600'),
+		`X-Bridge-Token: ${token}\n`
 	);
 }
 
-async function injectClaudeHooks(
-	target: ContainerTarget,
-	settingsJson: string
-): Promise<{ ok: boolean; error?: string }> {
-	const res = await execInContainer(target, {
-		script: mergeClaudeSettingsScript(),
-		stdin: settingsJson
-	});
-	return res.ok ? { ok: true } : { ok: false, error: res.error };
+/** Matches the delimited `id=<id>&state=` fragment of the hook's curl URL, so no other instance id can match by substring. */
+export function hasAttentionHook(settings: Record<string, unknown> | null, id: string): boolean {
+	if (settings === null) return false;
+	return JSON.stringify(settings.hooks ?? null).includes(`id=${encodeURIComponent(id)}&state=`);
 }
 
 export const attentionHooks: Injection = {
@@ -97,8 +84,7 @@ export const attentionHooks: Injection = {
 			log(`⚠ Claude hook injection failed: ${header.error}\n`);
 			return;
 		}
-		const settings = attentionHookSettings(target.instance.id);
-		const hooks = await injectClaudeHooks(target, settings);
+		const hooks = await mergeClaudeSettings(target, attentionHookSettings(target.instance.id));
 		log(
 			hooks.ok
 				? '✓ Claude attention hooks installed\n'
@@ -107,11 +93,6 @@ export const attentionHooks: Injection = {
 	},
 
 	async check(target) {
-		return checkPresence(
-			target,
-			'h=$(eval echo ~$(id -un)); d="${CLAUDE_CONFIG_DIR:-$h/.claude}"; ' +
-				'[ -s "$d/settings.json" ] && grep -q "$1" "$d/settings.json" && echo 1 || echo 0',
-			['attention-check', target.instance.id]
-		);
+		return hasAttentionHook(await readClaudeSettings(target), target.instance.id);
 	}
 };

package/src/container-injections/claude-aliases.ts

@@ -1,4 +1,8 @@
-import { checkPresence, execInContainer } from '../lib/exec.server.ts';
+import {
+	appendLinesIfAbsent,
+	linesPresent,
+	SHELL_RC_FILES
+} from '../lib/container-files.server.ts';
 import type { Injection } from '../lib/injections.server.ts';
 
 /** Both resolve `claude`, which `claude-skip-permissions` also aliases, so the two compose. */
@@ -7,37 +11,17 @@ const ALIAS_LINES = [
 	"alias cs='claude --model sonnet'"
 ];
 
-/** Lines arrive as `$@` so no alias text is interpolated into the loop body. */
-const APPLY_SCRIPT =
-	'h=$(eval echo ~$(id -un)); ' +
-	'for line in "$@"; do ' +
-	'for f in "$h/.bashrc" "$h/.zshrc"; do ' +
-	'grep -qF "$line" "$f" 2>/dev/null || printf \'%s\\n\' "$line" >> "$f"; ' +
-	'done; ' +
-	'done';
-
-const CHECK_SCRIPT =
-	'h=$(eval echo ~$(id -un)); ' +
-	'for line in "$@"; do ' +
-	'grep -qF "$line" "$h/.bashrc" 2>/dev/null || grep -qF "$line" "$h/.zshrc" 2>/dev/null || ' +
-	'{ echo 0; exit 0; }; ' +
-	'done; ' +
-	'echo 1';
-
 export const claudeAliases: Injection = {
 	id: 'claude-aliases',
 	label: 'claude aliases',
 
 	async apply(target, log) {
 		log('Installing c200 / cs claude aliases…\n');
-		const res = await execInContainer(target, {
-			script: APPLY_SCRIPT,
-			args: ['claude-aliases', ...ALIAS_LINES]
-		});
+		const res = await appendLinesIfAbsent(target, SHELL_RC_FILES, ALIAS_LINES);
 		log(res.ok ? '✓ claude aliases installed\n' : `⚠ claude aliases setup failed: ${res.error}\n`);
 	},
 
 	async check(target) {
-		return checkPresence(target, CHECK_SCRIPT, ['claude-aliases', ...ALIAS_LINES]);
+		return linesPresent(target, SHELL_RC_FILES, ALIAS_LINES);
 	}
 };

package/src/container-injections/claude-code-credentials.ts

@@ -4,7 +4,9 @@ import { homedir } from 'node:os';
 import { join } from 'node:path';
 import { CLAUDE_CODE_TOKEN, CLAUDE_KEYCHAIN_SERVICE } from '../lib/config.server.ts';
 import { getOption } from '../lib/db.server.ts';
-import { checkPresence, execInContainer, writeSecretFileScript } from '../lib/exec.server.ts';
+import { checkPresence } from '../lib/exec.server.ts';
+import { deepMerge, editJsonFile, writeContainerFile } from '../lib/container-files.server.ts';
+import { CLAUDE_JSON_FILE, claudeConfigFile } from '../lib/claude-settings.server.ts';
 import { spawnCapture } from '../lib/spawn.server.ts';
 import type { ContainerTarget, Injection } from '../lib/injections.server.ts';
 
@@ -95,13 +97,15 @@ async function injectClaudeCredentials(
 	target: ContainerTarget,
 	creds: string
 ): Promise<{ ok: boolean; error?: string }> {
-	const script =
-		'h=$(eval echo ~$(id -un)); d="${CLAUDE_CONFIG_DIR:-$h/.claude}"; ' +
-		writeSecretFileScript('$d', '.credentials.json', '600') +
-		' cfg="${CLAUDE_CONFIG_DIR:+$CLAUDE_CONFIG_DIR/.claude.json}"; cfg="${cfg:-$h/.claude.json}"; ' +
-		'printf \'%s\' \'{"hasCompletedOnboarding":true}\' > "$cfg"; chmod 644 "$cfg"';
-	const res = await execInContainer(target, { script, stdin: creds });
-	return res.ok ? { ok: true } : { ok: false, error: res.error };
+	const wrote = await writeContainerFile(
+		target,
+		claudeConfigFile('.credentials.json', '600'),
+		creds
+	);
+	if (!wrote.ok) return wrote;
+	return editJsonFile(target, CLAUDE_JSON_FILE, (cur) =>
+		deepMerge(cur, { hasCompletedOnboarding: true })
+	);
 }
 
 /**

package/src/container-injections/claude-code-custom.ts

@@ -1,5 +1,13 @@
 import { getOption } from '../lib/db.server.ts';
-import { checkPresence, execInContainer } from '../lib/exec.server.ts';
+import {
+	containerFileExists,
+	shellEnvFile,
+	deepMerge,
+	editJsonFile,
+	installShellEnvFile,
+	shellSingleQuote
+} from '../lib/container-files.server.ts';
+import { CLAUDE_JSON_FILE } from '../lib/claude-settings.server.ts';
 import type { ContainerTarget, Injection } from '../lib/injections.server.ts';
 
 /** Mirrors the reference launcher script (claude-code.sh); each is overridable in Settings. */
@@ -35,57 +43,36 @@ export function customEndpointConfig(): {
 	};
 }
 
-const ENV_FILE = '~/.codebay-claude-env';
+const ENV_FILE_NAME = '.codebay-claude-env';
+
+/** The whole file (token included) rides `stdin` inside `installShellEnvFile`, so nothing hits argv. */
+function envFileContent(config: NonNullable<ReturnType<typeof customEndpointConfig>>): string {
+	return (
+		[
+			'export DISABLE_AUTOUPDATER=1',
+			'export CLAUDE_CODE_USE_BEDROCK=1',
+			'export CLAUDE_CODE_SKIP_BEDROCK_AUTH=1',
+			`export ANTHROPIC_BEDROCK_BASE_URL=${shellSingleQuote(config.baseUrl)}`,
+			`export ANTHROPIC_AUTH_TOKEN=${shellSingleQuote(config.token)}`,
+			`export ANTHROPIC_DEFAULT_OPUS_MODEL=${shellSingleQuote(config.opusModel)}`,
+			`export ANTHROPIC_DEFAULT_SONNET_MODEL=${shellSingleQuote(config.sonnetModel)}`,
+			`export ANTHROPIC_DEFAULT_HAIKU_MODEL=${shellSingleQuote(config.haikuModel)}`,
+			`export ANTHROPIC_SMALL_FAST_MODEL=${shellSingleQuote(config.smallFastModel)}`,
+			`export ANTHROPIC_MODEL=${shellSingleQuote(config.defaultModel)}`
+		].join('\n') + '\n'
+	);
+}
 
-/**
- * Non-secret values ride `args`, so nothing needs hand-quoting; only the token uses `stdin`.
- * The file mixes secret and non-secret content, hence no `writeSecretFileScript`.
- */
 async function injectCustomEndpoint(
 	target: ContainerTarget,
 	config: NonNullable<ReturnType<typeof customEndpointConfig>>
 ): Promise<{ ok: boolean; error?: string }> {
-	const script =
-		'set -e; f=$(eval echo "' +
-		ENV_FILE +
-		'"); ' +
-		'{ ' +
-		"printf '%s\\n' " +
-		"'export DISABLE_AUTOUPDATER=1' " +
-		"'export CLAUDE_CODE_USE_BEDROCK=1' " +
-		"'export CLAUDE_CODE_SKIP_BEDROCK_AUTH=1'; " +
-		'printf \'export ANTHROPIC_BEDROCK_BASE_URL=%s\\n\' "$1"; ' +
-		'printf \'export ANTHROPIC_AUTH_TOKEN=%s\\n\' "$CODEBAY_STDIN"; ' +
-		'printf \'export ANTHROPIC_DEFAULT_OPUS_MODEL=%s\\n\' "$2"; ' +
-		'printf \'export ANTHROPIC_DEFAULT_SONNET_MODEL=%s\\n\' "$3"; ' +
-		'printf \'export ANTHROPIC_DEFAULT_HAIKU_MODEL=%s\\n\' "$4"; ' +
-		'printf \'export ANTHROPIC_SMALL_FAST_MODEL=%s\\n\' "$5"; ' +
-		'printf \'export ANTHROPIC_MODEL=%s\\n\' "$6"; ' +
-		'} > "$f"; chmod 600 "$f"; ' +
-		// The grep guard keeps a re-apply from stacking duplicate source lines.
-		'h=$(eval echo ~$(id -un)); src="[ -f \\"$f\\" ] && . \\"$f\\""; ' +
-		'for rc in "$h/.bashrc" "$h/.zshrc"; do ' +
-		'grep -qF "$src" "$rc" 2>/dev/null || printf \'%s\\n\' "$src" >> "$rc"; ' +
-		'done; ' +
-		// `hasCompletedOnboarding` is what suppresses `claude`'s first-run wizard.
-		'h=$(eval echo ~$(id -un)); ' +
-		'cfg="${CLAUDE_CONFIG_DIR:+$CLAUDE_CONFIG_DIR/.claude.json}"; cfg="${cfg:-$h/.claude.json}"; ' +
-		'printf \'%s\' \'{"hasCompletedOnboarding":true}\' > "$cfg"; chmod 644 "$cfg"';
-
-	const res = await execInContainer(target, {
-		script,
-		stdin: config.token,
-		args: [
-			'claude-custom',
-			config.baseUrl,
-			config.opusModel,
-			config.sonnetModel,
-			config.haikuModel,
-			config.smallFastModel,
-			config.defaultModel
-		]
-	});
-	return res.ok ? { ok: true } : { ok: false, error: res.error };
+	const env = await installShellEnvFile(target, ENV_FILE_NAME, envFileContent(config));
+	if (!env.ok) return env;
+	// `hasCompletedOnboarding` is what suppresses `claude`'s first-run wizard.
+	return editJsonFile(target, CLAUDE_JSON_FILE, (cur) =>
+		deepMerge(cur, { hasCompletedOnboarding: true })
+	);
 }
 
 /** Replaces `claude-code-credentials` in the registry when the custom-endpoint setting is on. */
@@ -120,6 +107,6 @@ export const claudeCodeCustom: Injection = {
 	},
 
 	async check(target) {
-		return checkPresence(target, `f=$(eval echo "${ENV_FILE}"); [ -s "$f" ] && echo 1 || echo 0`);
+		return containerFileExists(target, shellEnvFile(ENV_FILE_NAME));
 	}
 };

package/src/container-injections/claude-code-ide-extension.ts

@@ -0,0 +1,39 @@
+import { checkPresence, execInContainer } from '../lib/exec.server.ts';
+import type { Injection } from '../lib/injections.server.ts';
+
+/** On Open VSX (code-server's default registry); the Marketplace build `/ide` targets is unreachable. */
+export const EXTENSION_ID = 'anthropic.claude-code';
+
+const EXT_GLOB = '~/.local/share/code-server/extensions/anthropic.claude-code-*';
+
+/** Idempotent (skips if already present); best-effort — needs Open VSX egress. */
+export const INSTALL_SCRIPT =
+	`if ls -d ${EXT_GLOB} >/dev/null 2>&1; then exit 0; fi; ` +
+	`command -v code-server >/dev/null 2>&1 || { echo "code-server not found" >&2; exit 1; }; ` +
+	`code-server --install-extension ${EXTENSION_ID}`;
+
+export const CHECK_SCRIPT = `ls -d ${EXT_GLOB} >/dev/null 2>&1 && echo 1 || echo 0`;
+
+/**
+ * Runtime fallback to the build-time launch-line install in CODE_SERVER_LAUNCH; failure is
+ * non-fatal since the IDE integration is optional and everything else works without it.
+ */
+export const claudeCodeIdeExtension: Injection = {
+	id: 'claude-code-ide-extension',
+	label: 'Claude Code IDE extension',
+
+	async apply(target, log) {
+		log('Installing Claude Code IDE extension…\n');
+		// Full target (with remoteUser) so it lands in that user's code-server home, where code-server reads it.
+		const res = await execInContainer(target, { script: INSTALL_SCRIPT });
+		log(
+			res.ok
+				? '✓ Claude Code IDE extension installed\n'
+				: `⚠ Claude Code IDE extension install failed: ${res.error} — /ide integration off\n`
+		);
+	},
+
+	async check(target) {
+		return checkPresence(target, CHECK_SCRIPT);
+	}
+};

package/src/container-injections/claude-code-models.ts

@@ -1,5 +1,5 @@
 import { getOption } from '../lib/db.server.ts';
-import { execInContainer } from '../lib/exec.server.ts';
+import { installShellEnvFile, shellSingleQuote } from '../lib/container-files.server.ts';
 import type { ContainerTarget, Injection } from '../lib/injections.server.ts';
 
 /** The option key → Claude env var mapping; order is the field order in Settings. */
@@ -26,33 +26,17 @@ export function manualModelConfig(): Record<string, string> | null {
 	return Object.keys(filled).length ? filled : null;
 }
 
-const ENV_FILE = '~/.codebay-claude-models-env';
+const ENV_FILE_NAME = '.codebay-claude-models-env';
 
-/** Model IDs are non-secret, so every value rides `args` ($1, $2, …) — no stdin. */
-async function injectModels(
+function injectModels(
 	target: ContainerTarget,
 	config: Record<string, string>
 ): Promise<{ ok: boolean; error?: string }> {
-	const entries = Object.entries(config);
-	const writes = entries.map(([env], i) => `printf 'export ${env}=%s\\n' "$${i + 1}"; `).join('');
-	const script =
-		'set -e; f=$(eval echo "' +
-		ENV_FILE +
-		'"); ' +
-		'{ ' +
-		writes +
-		'} > "$f"; chmod 600 "$f"; ' +
-		// The grep guard keeps a re-apply from stacking duplicate source lines.
-		'h=$(eval echo ~$(id -un)); src="[ -f \\"$f\\" ] && . \\"$f\\""; ' +
-		'for rc in "$h/.bashrc" "$h/.zshrc"; do ' +
-		'grep -qF "$src" "$rc" 2>/dev/null || printf \'%s\\n\' "$src" >> "$rc"; ' +
-		'done';
-
-	const res = await execInContainer(target, {
-		script,
-		args: ['claude-models', ...entries.map(([, value]) => value)]
-	});
-	return res.ok ? { ok: true } : { ok: false, error: res.error };
+	const content =
+		Object.entries(config)
+			.map(([env, value]) => `export ${env}=${shellSingleQuote(value)}`)
+			.join('\n') + '\n';
+	return installShellEnvFile(target, ENV_FILE_NAME, content);
 }
 
 /** Sets Claude model env vars on the standard path; skipped when LiteLLM is active. */

package/src/container-injections/claude-model.ts

@@ -1,8 +1,7 @@
 import { getOption } from '../lib/db.server.ts';
-import { checkPresence, execInContainer } from '../lib/exec.server.ts';
-import { mergeClaudeSettingsScript } from './attention-hooks.ts';
+import { mergeClaudeSettings, readClaudeSettings } from '../lib/claude-settings.server.ts';
 import { readHostClaudeSettings } from './claude-statusline.ts';
-import type { ContainerTarget, Injection } from '../lib/injections.server.ts';
+import type { Injection } from '../lib/injections.server.ts';
 
 /** The app's own model config (manual override / LiteLLM) exports ANTHROPIC_MODEL, which wins over settings.json. */
 function appOwnsModel(): boolean {
@@ -20,35 +19,16 @@ export async function hostClaudeModel(): Promise<string | null> {
 	return typeof model === 'string' && model.trim() ? model.trim() : null;
 }
 
-async function injectModel(
-	target: ContainerTarget,
-	model: string
-): Promise<{ ok: boolean; error?: string }> {
-	const res = await execInContainer(target, {
-		script: mergeClaudeSettingsScript(),
-		stdin: JSON.stringify({ model })
-	});
-	return res.ok ? { ok: true } : { ok: false, error: res.error };
-}
-
 /** Mirrors the host's default `model` into the container so subscription instances match the host. */
 export const claudeModel: Injection = {
 	id: 'claude-model',
 	label: 'model default',
 
-	auth: {
-		hint: 'set `model` in ~/.claude/settings.json',
-		async status() {
-			const model = await hostClaudeModel();
-			return { available: model !== null, source: model ? '~/.claude/settings.json' : null };
-		}
-	},
-
 	async apply(target, log) {
 		const model = await hostClaudeModel();
 		if (!model) return;
 		log(`Injecting Claude model default (${model})…\n`);
-		const result = await injectModel(target, model);
+		const result = await mergeClaudeSettings(target, { model });
 		log(
 			result.ok
 				? '✓ Claude model default configured in container\n'
@@ -57,10 +37,7 @@ export const claudeModel: Injection = {
 	},
 
 	async check(target) {
-		return checkPresence(
-			target,
-			'h=$(eval echo ~$(id -un)); d="${CLAUDE_CONFIG_DIR:-$h/.claude}"; ' +
-				'[ -s "$d/settings.json" ] && grep -q \'"model"\' "$d/settings.json" && echo 1 || echo 0'
-		);
+		const settings = await readClaudeSettings(target);
+		return typeof settings?.model === 'string' && settings.model.trim() !== '';
 	}
 };

package/src/container-injections/claude-no-coauthor.ts

@@ -1,6 +1,5 @@
-import { checkPresence, execInContainer } from '../lib/exec.server.ts';
-import { mergeClaudeSettingsScript } from './attention-hooks.ts';
-import type { ContainerTarget, Injection } from '../lib/injections.server.ts';
+import { mergeClaudeSettings, readClaudeSettings } from '../lib/claude-settings.server.ts';
+import type { Injection } from '../lib/injections.server.ts';
 
 /**
  * Both schemas on purpose: newer `claude` reads the nested `attribution` object, older builds
@@ -12,14 +11,6 @@ export const NO_COAUTHOR_SETTINGS = {
 	attribution: { commit: '', pr: '', includeCoAuthoredBy: false }
 };
 
-async function injectNoCoauthor(target: ContainerTarget): Promise<{ ok: boolean; error?: string }> {
-	const res = await execInContainer(target, {
-		script: mergeClaudeSettingsScript(),
-		stdin: JSON.stringify(NO_COAUTHOR_SETTINGS)
-	});
-	return res.ok ? { ok: true } : { ok: false, error: res.error };
-}
-
 /** A Codebay-wide default rather than an opt-in setting, hence no `auth` block. */
 export const claudeNoCoauthor: Injection = {
 	id: 'claude-no-coauthor',
@@ -27,7 +18,7 @@ export const claudeNoCoauthor: Injection = {
 
 	async apply(target, log) {
 		log('Disabling Claude co-author commit byline…\n');
-		const result = await injectNoCoauthor(target);
+		const result = await mergeClaudeSettings(target, NO_COAUTHOR_SETTINGS);
 		log(
 			result.ok
 				? '✓ Claude co-author byline disabled\n'
@@ -36,10 +27,7 @@ export const claudeNoCoauthor: Injection = {
 	},
 
 	async check(target) {
-		return checkPresence(
-			target,
-			'h=$(eval echo ~$(id -un)); d="${CLAUDE_CONFIG_DIR:-$h/.claude}"; ' +
-				'[ -s "$d/settings.json" ] && grep -q includeCoAuthoredBy "$d/settings.json" && echo 1 || echo 0'
-		);
+		const settings = await readClaudeSettings(target);
+		return settings !== null && 'includeCoAuthoredBy' in settings;
 	}
 };

package/src/container-injections/claude-skip-permissions.ts

@@ -1,22 +1,12 @@
-import { checkPresence, execInContainer } from '../lib/exec.server.ts';
+import {
+	appendLinesIfAbsent,
+	linesPresent,
+	SHELL_RC_FILES
+} from '../lib/container-files.server.ts';
 import type { Injection } from '../lib/injections.server.ts';
 
 const ALIAS_LINE = "alias claude='claude --dangerously-skip-permissions'";
 
-/** Both rc files, since either shell may be the one code-server opens. */
-const APPLY_SCRIPT =
-	'h=$(eval echo ~$(id -un)); ' +
-	`line="${ALIAS_LINE}"; ` +
-	'for f in "$h/.bashrc" "$h/.zshrc"; do ' +
-	'grep -qF "$line" "$f" 2>/dev/null || printf \'%s\\n\' "$line" >> "$f"; ' +
-	'done';
-
-const CHECK_SCRIPT =
-	'h=$(eval echo ~$(id -un)); ' +
-	`line="${ALIAS_LINE}"; ` +
-	'if grep -qF "$line" "$h/.bashrc" 2>/dev/null || grep -qF "$line" "$h/.zshrc" 2>/dev/null; ' +
-	'then echo 1; else echo 0; fi';
-
 /** Safe here only because instances are throwaway, single-tenant sandboxes. */
 export const claudeSkipPermissions: Injection = {
 	id: 'claude-skip-permissions',
@@ -24,7 +14,7 @@ export const claudeSkipPermissions: Injection = {
 
 	async apply(target, log) {
 		log('Installing claude --dangerously-skip-permissions alias…\n');
-		const res = await execInContainer(target, { script: APPLY_SCRIPT });
+		const res = await appendLinesIfAbsent(target, SHELL_RC_FILES, [ALIAS_LINE]);
 		log(
 			res.ok
 				? '✓ claude skip-permissions alias installed\n'
@@ -33,6 +23,6 @@ export const claudeSkipPermissions: Injection = {
 	},
 
 	async check(target) {
-		return checkPresence(target, CHECK_SCRIPT);
+		return linesPresent(target, SHELL_RC_FILES, [ALIAS_LINE]);
 	}
 };

package/src/container-injections/claude-statusline.ts

@@ -2,8 +2,12 @@ import { existsSync, statSync } from 'node:fs';
 import { readFile } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
-import { checkPresence, execInContainer } from '../lib/exec.server.ts';
-import { mergeClaudeSettingsScript } from './attention-hooks.ts';
+import { writeContainerFile } from '../lib/container-files.server.ts';
+import {
+	claudeConfigFile,
+	mergeClaudeSettings,
+	readClaudeSettings
+} from '../lib/claude-settings.server.ts';
 import type { ContainerTarget, Injection } from '../lib/injections.server.ts';
 
 /** Left unexpanded — Claude Code invokes this long after the injection has finished. */
@@ -65,23 +69,20 @@ export async function readStatusLineConfig(): Promise<StatusLineConfig | null> {
 	return { statusLine: { ...statusLine, command }, script };
 }
 
-/** Two execs rather than one, because `execInContainer` carries a single `stdin` payload per call. */
+/** A referenced script is staged first, then the statusLine block is merged into settings.json. */
 async function injectStatusLine(
 	target: ContainerTarget,
 	config: StatusLineConfig
 ): Promise<{ ok: boolean; error?: string }> {
 	if (config.script) {
-		const writeScript =
-			'h=$(eval echo ~$(id -un)); d="${CLAUDE_CONFIG_DIR:-$h/.claude}"; mkdir -p "$d"; ' +
-			'printf \'%s\' "$CODEBAY_STDIN" > "$d/statusline.sh"; chmod 755 "$d/statusline.sh"';
-		const res = await execInContainer(target, { script: writeScript, stdin: config.script });
-		if (!res.ok) return { ok: false, error: res.error };
+		const wrote = await writeContainerFile(
+			target,
+			claudeConfigFile('statusline.sh', '755'),
+			config.script
+		);
+		if (!wrote.ok) return wrote;
 	}
-	const res = await execInContainer(target, {
-		script: mergeClaudeSettingsScript(),
-		stdin: JSON.stringify({ statusLine: config.statusLine })
-	});
-	return res.ok ? { ok: true } : { ok: false, error: res.error };
+	return mergeClaudeSettings(target, { statusLine: config.statusLine });
 }
 
 export const claudeStatusline: Injection = {
@@ -115,10 +116,7 @@ export const claudeStatusline: Injection = {
 	},
 
 	async check(target) {
-		return checkPresence(
-			target,
-			'h=$(eval echo ~$(id -un)); d="${CLAUDE_CONFIG_DIR:-$h/.claude}"; ' +
-				'[ -s "$d/settings.json" ] && grep -q statusLine "$d/settings.json" && echo 1 || echo 0'
-		);
+		const settings = await readClaudeSettings(target);
+		return !!settings?.statusLine;
 	}
 };

package/src/container-injections/claude-trust.ts

@@ -0,0 +1,73 @@
+import { deepMerge, editJsonFile, readJsonFile } from '../lib/container-files.server.ts';
+import {
+	CLAUDE_JSON_FILE,
+	mergeClaudeSettings,
+	readClaudeSettings
+} from '../lib/claude-settings.server.ts';
+import type { Injection } from '../lib/injections.server.ts';
+
+/**
+ * Pre-accepts the three prompts `claude` shows on first launch, so a throwaway instance
+ * opens straight into a session: the folder-trust dialog and the MCP-server approval
+ * (both per-project, keyed by the path `claude` runs in), and the one-time Bypass
+ * Permissions acknowledgement (`--dangerously-skip-permissions` still trips it without this).
+ * Key names verified against the shipped `claude` binary.
+ */
+export function claudeTrustConfig(workspacePath: string | null): Record<string, unknown> {
+	const cfg: Record<string, unknown> = {
+		// Idempotent with the credentials injection; keeps this self-sufficient when auth is skipped.
+		hasCompletedOnboarding: true,
+		bypassPermissionsModeAccepted: true
+	};
+	if (workspacePath) {
+		cfg.projects = {
+			[workspacePath]: {
+				hasTrustDialogAccepted: true,
+				hasCompletedProjectOnboarding: true,
+				enableAllProjectMcpServers: true
+			}
+		};
+	}
+	return cfg;
+}
+
+/** claude ≥2.1.220 keeps the bypass acknowledgement here; the `.claude.json` key stays for older versions. */
+export const CLAUDE_TRUST_SETTINGS: Record<string, unknown> = {
+	skipDangerousModePermissionPrompt: true
+};
+
+/** Safe here only because instances are throwaway, single-tenant sandboxes. */
+export const claudeTrust: Injection = {
+	id: 'claude-trust',
+	label: 'Claude trust & MCP auto-accept',
+
+	async apply(target, log) {
+		log('Pre-accepting Claude trust, MCP, and bypass-permissions prompts…\n');
+		// deepMerge recurses into `projects`, so the per-project keys layer onto any existing entries.
+		const res = await editJsonFile(target, CLAUDE_JSON_FILE, (cur) =>
+			deepMerge(cur, claudeTrustConfig(target.instance.remote_workspace_folder))
+		);
+		if (!res.ok) {
+			log(`⚠ Claude trust injection failed: ${res.error}\n`);
+			return;
+		}
+		const settings = await mergeClaudeSettings(target, CLAUDE_TRUST_SETTINGS);
+		log(
+			settings.ok
+				? '✓ Claude startup prompts pre-accepted\n'
+				: `⚠ Claude trust injection failed: ${settings.error}\n`
+		);
+	},
+
+	// Not keyed on `.claude.json`'s `bypassPermissionsModeAccepted`: claude ≥2.1.220 drops
+	// that key (and `enableAllProjectMcpServers`) when it rewrites the file after startup.
+	async check(target) {
+		const settings = await readClaudeSettings(target);
+		if (settings?.skipDangerousModePermissionPrompt !== true) return false;
+		const workspace = target.instance.remote_workspace_folder;
+		if (!workspace) return true;
+		const cfg = await readJsonFile(target, CLAUDE_JSON_FILE);
+		const projects = cfg?.projects as Record<string, Record<string, unknown>> | undefined;
+		return projects?.[workspace]?.hasTrustDialogAccepted === true;
+	}
+};