shadok-ai 0.17.3 → 0.17.4

package/dist/selfrepo.d.ts

@@ -6,8 +6,16 @@
  * diff before connecting any GitHub account.
  */
 export declare const SELF_REPO_URL = "https://github.com/shadok-ai/shadok-ai.git";
-/** Our own copy, never the directory the running server was launched from. */
-export declare function selfRepoDir(): string;
+/**
+ * Our own copy, never the directory the running server was launched from.
+ * `stateHome` defaults to the server's own home (mono-tenant / commons before
+ * migration), but is the DROPPED agent's home (`/home/<user>`) once agents run
+ * as a non-root OS user: the server's `/root` is mode 0700 and un-traversable by
+ * that user, so a clone there strands the Tweak agent — same reason as
+ * `worktreeDir` in `worktree.ts`. The caller makes the clone writable by the
+ * drop user; this only fixes WHERE it lands.
+ */
+export declare function selfRepoDir(stateHome?: string): string;
 export type SelfRepoPlan = "clone" | "update" | "reclone";
 /** Pure: what to do with the checkout, given what is on disk. */
 export declare function selfRepoPlan(exists: boolean, isRepo: boolean): SelfRepoPlan;
@@ -26,4 +34,4 @@ export interface SelfRepoResult {
  * worktrees a tweak session owns are separate checkouts and are never touched —
  * refreshing under a live agent is how you lose its work.
  */
-export declare function ensureSelfRepo(): SelfRepoResult;
+export declare function ensureSelfRepo(stateHome?: string): SelfRepoResult;

package/dist/selfrepo.js

@@ -10,9 +10,17 @@ import path from "node:path";
  * diff before connecting any GitHub account.
  */
 export const SELF_REPO_URL = "https://github.com/shadok-ai/shadok-ai.git";
-/** Our own copy, never the directory the running server was launched from. */
-export function selfRepoDir() {
-    return path.join(os.homedir(), ".shadok-ai", "self", "shadok-ai");
+/**
+ * Our own copy, never the directory the running server was launched from.
+ * `stateHome` defaults to the server's own home (mono-tenant / commons before
+ * migration), but is the DROPPED agent's home (`/home/<user>`) once agents run
+ * as a non-root OS user: the server's `/root` is mode 0700 and un-traversable by
+ * that user, so a clone there strands the Tweak agent — same reason as
+ * `worktreeDir` in `worktree.ts`. The caller makes the clone writable by the
+ * drop user; this only fixes WHERE it lands.
+ */
+export function selfRepoDir(stateHome = os.homedir()) {
+    return path.join(stateHome, ".shadok-ai", "self", "shadok-ai");
 }
 /** Pure: what to do with the checkout, given what is on disk. */
 export function selfRepoPlan(exists, isRepo) {
@@ -48,8 +56,8 @@ function git(args, cwd) {
  * worktrees a tweak session owns are separate checkouts and are never touched —
  * refreshing under a live agent is how you lose its work.
  */
-export function ensureSelfRepo() {
-    const dir = selfRepoDir();
+export function ensureSelfRepo(stateHome = os.homedir()) {
+    const dir = selfRepoDir(stateHome);
     const plan = selfRepoPlan(fs.existsSync(dir), fs.existsSync(path.join(dir, ".git")));
     try {
         if (plan === "reclone")

package/dist/selfrepo.js.map

@@ -1 +1 @@
-{"version":3,"file":"selfrepo.js","sourceRoot":"","sources":["../src/selfrepo.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,4CAA4C,CAAC;AAE1E,8EAA8E;AAC9E,MAAM,UAAU,WAAW;IACzB,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;AACpE,CAAC;AAID,iEAAiE;AACjE,MAAM,UAAU,YAAY,CAAC,MAAe,EAAE,MAAe;IAC3D,IAAI,CAAC,MAAM;QAAE,OAAO,OAAO,CAAC;IAC5B,OAAO,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;AACvC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,CAAU;IACtC,MAAM,GAAG,GAAG,CAAuD,CAAC;IACpE,IAAI,GAAG,EAAE,IAAI,KAAK,QAAQ;QAAE,OAAO,sBAAsB,CAAC;IAC1D,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,EAAE,MAAM,IAAI,EAAE,CAAC;SACnC,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,IAAI,CAAC,OAAO,CAAC,CAAC;IACjB,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;AAClD,CAAC;AAOD,SAAS,GAAG,CAAC,IAAc,EAAE,GAAY;IACvC,YAAY,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;QACrD,QAAQ,EAAE,MAAM;QAChB,yDAAyD;QACzD,OAAO,EAAE,OAAO;QAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;KAClC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc;IAC5B,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;IAC1B,MAAM,IAAI,GAAG,YAAY,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IACrF,IAAI,CAAC;QACH,IAAI,IAAI,KAAK,SAAS;YAAE,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACzE,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC;YACzC,GAAG,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;YAC/B,wEAAwE;YACxE,6DAA6D;YAC7D,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,aAAa,CAAC,EAAE,GAAG,CAAC,CAAC;QAC/C,CAAC;aAAM,CAAC;YACN,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACrD,GAAG,CAAC,CAAC,OAAO,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC,CAAC;QACrC,CAAC;QACD,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;IACtB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;IACrC,CAAC;AACH,CAAC"}
+{"version":3,"file":"selfrepo.js","sourceRoot":"","sources":["../src/selfrepo.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,4CAA4C,CAAC;AAE1E;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,SAAS,GAAW,EAAE,CAAC,OAAO,EAAE;IAC1D,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;AACjE,CAAC;AAID,iEAAiE;AACjE,MAAM,UAAU,YAAY,CAAC,MAAe,EAAE,MAAe;IAC3D,IAAI,CAAC,MAAM;QAAE,OAAO,OAAO,CAAC;IAC5B,OAAO,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;AACvC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,CAAU;IACtC,MAAM,GAAG,GAAG,CAAuD,CAAC;IACpE,IAAI,GAAG,EAAE,IAAI,KAAK,QAAQ;QAAE,OAAO,sBAAsB,CAAC;IAC1D,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,EAAE,MAAM,IAAI,EAAE,CAAC;SACnC,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,IAAI,CAAC,OAAO,CAAC,CAAC;IACjB,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;AAClD,CAAC;AAOD,SAAS,GAAG,CAAC,IAAc,EAAE,GAAY;IACvC,YAAY,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;QACrD,QAAQ,EAAE,MAAM;QAChB,yDAAyD;QACzD,OAAO,EAAE,OAAO;QAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;KAClC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,SAAS,GAAW,EAAE,CAAC,OAAO,EAAE;IAC7D,MAAM,GAAG,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,YAAY,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IACrF,IAAI,CAAC;QACH,IAAI,IAAI,KAAK,SAAS;YAAE,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACzE,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC;YACzC,GAAG,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;YAC/B,wEAAwE;YACxE,6DAA6D;YAC7D,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,aAAa,CAAC,EAAE,GAAG,CAAC,CAAC;QAC/C,CAAC;aAAM,CAAC;YACN,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACrD,GAAG,CAAC,CAAC,OAAO,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC,CAAC;QACrC,CAAC;QACD,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;IACtB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;IACrC,CAAC;AACH,CAAC"}

package/dist/server.js

@@ -1554,7 +1554,9 @@ app.get("/diff", (req, res) => {
 // Past worktree sessions of a repo (for reopening unfinished work).
 app.get("/recover", (req, res) => {
     const repo = String(req.query.repo ?? "").trim() || process.cwd();
-    const list = isGitRepo(repo) ? listPastSessions(repo) : [];
+    const list = isGitRepo(repo)
+        ? listPastSessions(repo, agentStateHome(commonsOsUser({ migrated: groupsMigrated, mode: DEPLOYMENT_MODE })))
+        : [];
     // `repo` is a caller-supplied path: a caller who knows another group's HOME
     // could enumerate that group's past worktree sessions (branch/commit metadata +
     // first-prompt preview). Filter each past session to the caller's visible
@@ -1617,10 +1619,18 @@ app.put("/mute", (req, res) => {
 // Materialises shadok-ai's own source for the "Tweak Shadok-AI" CTA, and hands
 // back the directory to start the agent in. Sits here so it inherits the same
 // password gate as its neighbours.
-app.post("/tweak/prepare", (_req, res) => {
-    const r = ensureSelfRepo();
+app.post("/tweak/prepare", async (_req, res) => {
+    // The tweak agent runs as the commons drop user; its self-repo clone must live
+    // in THAT user's home (reachable under 0700 /root) and be owned by it — same
+    // reason as the worktree created off it. `commonsOsUser → null` in mono-tenant
+    // makes `agentStateHome(null)` the server home and the chown a no-op, so
+    // nothing changes there.
+    const commonsUser = commonsOsUser({ migrated: groupsMigrated, mode: DEPLOYMENT_MODE });
+    const r = ensureSelfRepo(agentStateHome(commonsUser));
     if (r.error)
         return res.status(500).json({ error: r.error });
+    if (r.cwd)
+        await chownAgentStateToDropUser(r.cwd, commonsUser);
     res.json({ cwd: r.cwd });
 });
 // Running version + latest seen on npm (null if not yet polled / check disabled).
@@ -2120,11 +2130,16 @@ app.post("/groups/members", (req, res) => {
 // DEPLOYMENT_MODE gate and the honest-failure rules (T3/T4) all live here. ──────
 /** Where a group's HOME is created (`SHADOK_HOME_BASE` override, else `/home`). */
 const GROUP_HOME_BASE = (process.env.SHADOK_HOME_BASE ?? "").trim() || DEFAULT_HOME_BASE;
-/** The HOME whose `.claude/projects` holds a given agent's transcript: the drop
- *  user's own home when the agent is privilege-dropped (multi-tenant isolation),
- *  else the server's own home (commons / mono-tenant). The single answer the
- *  content tail and `loadHistory` must use so an isolated agent's reply streams. */
-function agentTranscriptHome(user) {
+/** The HOME that holds ALL of an agent's on-disk state: its transcript
+ *  (`.claude/projects`, read by the content tail and `loadHistory`) AND its
+ *  worktrees + self-repo clone (`.shadok-ai/worktrees`, `.shadok-ai/self`). The
+ *  drop user's own home when the agent is privilege-dropped (multi-tenant
+ *  isolation), else the server's own home (commons / mono-tenant). The single
+ *  answer every one of those paths must use: the server's `/root` is mode 0700
+ *  and un-traversable by a dropped user, so state created there is silently
+ *  unreachable — a reply that never streams, or a Tweak agent wedged on Claude
+ *  Code's invalid-settings screen (its worktree lived under `/root`). */
+function agentStateHome(user) {
     return user ? homeForUser(user, GROUP_HOME_BASE) : os.homedir();
 }
 /** The COMMONS tier for secret resolution: Main plus every PUBLIC non-Main group.
@@ -2138,11 +2153,13 @@ function commonsGroupIds() {
             ids.push(g.id);
     return ids;
 }
-/** The transcript HOME for a CHANNEL that may not be live (e.g. GET /download of
- *  a past session): a live session's own `transcriptHome` when we have it, else
- *  re-derived from the channel's group the same way a spawn's drop user is —
- *  the group's `sk-*` user, or the commons user when migrated, else the server. */
-function channelTranscriptHome(chan) {
+/** The state HOME for a CHANNEL that may not be live (e.g. GET /download of a
+ *  past session, or pruning a worktree as the session ends): a live session's
+ *  own `transcriptHome` when we have it, else re-derived from the channel's
+ *  group the same way a spawn's drop user is — the group's `sk-*` user, or the
+ *  commons user when migrated, else the server. Governs both the transcript and
+ *  the worktree location, so prune finds exactly what the spawn created. */
+function channelStateHome(chan) {
     const live = sessions.get(chan.sessionId);
     if (live)
         return live.transcriptHome;
@@ -2150,7 +2167,7 @@ function channelTranscriptHome(chan) {
         return os.homedir();
     const g = chan.group ? loadGroups().find((x) => x.id === chan.group) : null;
     const user = (g ? osUserFor(g) : null) ?? commonsOsUser({ migrated: groupsMigrated, mode: DEPLOYMENT_MODE });
-    return agentTranscriptHome(user);
+    return agentStateHome(user);
 }
 /** Task 12: the one shared pot every group HOME links as `~/shared`. */
 const SHARED_POT_PATH = (process.env.SHADOK_SHARED_POT_PATH ?? "").trim() || DEFAULT_SHARED_POT_PATH;
@@ -2171,6 +2188,43 @@ function runPrivileged(cmd, argv) {
         p.on("exit", (code) => (code === 0 ? resolve() : reject(new Error(`${cmd} exited with code ${code}`))));
     });
 }
+/**
+ * Make a freshly-created worktree (or self-repo clone) usable by the DROP USER.
+ * The server creates it as ROOT, so the checkout AND git's own worktree admin
+ * dir (`<repo>/.git/worktrees/<name>`, where the agent's index/HEAD/logs live)
+ * are root-owned — and a dropped agent could neither write them nor, before this
+ * fix, even reach them under the 0700 server HOME. Now the checkout lives in the
+ * drop user's OWN home (`agentStateHome` → `worktreeDir`), so only ownership is
+ * left: chown BOTH the checkout and (for a worktree) its external admin dir to
+ * the user. Best-effort and logged — a chown failure degrades to the old symptom
+ * rather than failing the spawn, and the log names it. No-op with no drop user
+ * (mono-tenant, or commons-as-root before migration): ownership is already right.
+ */
+async function chownAgentStateToDropUser(checkout, user) {
+    if (!user)
+        return;
+    const owner = `${user}:${user}`;
+    try {
+        await runPrivileged("chown", ["-R", owner, checkout]);
+        // git's admin dir sits under the REPO's gitdir, not the checkout; resolve it
+        // from inside the checkout so a worktree `.git` FILE is followed to it. Only
+        // chown it when OUTSIDE the checkout (a worktree); for a plain clone it is
+        // `<checkout>/.git`, already covered by the recursive chown above.
+        let adminDir = "";
+        try {
+            adminDir = execFileSync("git", ["-C", checkout, "rev-parse", "--absolute-git-dir"], { encoding: "utf8", timeout: 10_000 }).trim();
+        }
+        catch {
+            /* not a git checkout: the recursive chown already covered it */
+        }
+        if (adminDir && !adminDir.startsWith(path.resolve(checkout) + path.sep)) {
+            await runPrivileged("chown", ["-R", owner, adminDir]);
+        }
+    }
+    catch (e) {
+        console.warn(`state chown to ${user} failed for ${checkout} (agent may be unable to write it): ${e?.message ?? e}`);
+    }
+}
 /** The shadok skills to install: [package source dir, installed name]. Mirrored
  *  into the SERVER HOME by `seedXxxSkill` and, for multi-user isolation, into the
  *  machine-wide ENTERPRISE tier by `seedSystemSkills`. */
@@ -4125,7 +4179,7 @@ app.get("/download", (req, res) => {
     if (!allowed) {
         let raw;
         try {
-            raw = fs.readFileSync(transcriptFilePath(chan.cwd, session, channelTranscriptHome(chan)), "utf8");
+            raw = fs.readFileSync(transcriptFilePath(chan.cwd, session, channelStateHome(chan)), "utf8");
         }
         catch {
             return res.status(403).type("text").send("that file was not sent by this agent");
@@ -5162,6 +5216,12 @@ async function endChannel(sessionId) {
     const s = sessions.get(sessionId);
     const worktreeBranch = s?.worktree?.branch ?? ch?.branch;
     const repo = s?.worktree?.repo ?? ch?.repo;
+    // Resolve the worktree's home WHILE the session is still live (its own
+    // `transcriptHome` is the exact home the spawn created it in); fall back to the
+    // channel's group-derived home once it is gone. Prune must look in the same
+    // place createWorktree wrote, or a dropped agent's checkout under /home/<user>
+    // would never be cleaned.
+    const worktreeHome = s?.transcriptHome ?? (ch ? channelStateHome(ch) : os.homedir());
     if (s) {
         broadcast(s, { type: "stopped" });
         await s.pilot.stop().catch(() => { });
@@ -5171,7 +5231,7 @@ async function endChannel(sessionId) {
     // merged), keep it if there's uncommitted or unmerged work. Stops the empty-
     // worktree pile-up while never discarding real work.
     if (repo && worktreeBranch) {
-        const outcome = pruneWorktree(repo, worktreeBranch);
+        const outcome = pruneWorktree(repo, worktreeBranch, worktreeHome);
         if (outcome !== "none")
             console.log(`worktree ${worktreeBranch}: ${outcome} on session end`);
     }
@@ -5270,8 +5330,8 @@ group = null) {
     const pilot = makePilot(id, cwd, args, profile, model, effort, user, group);
     // A dropped group agent writes its transcript under ITS OWN home, not the
     // server's — so the content tail / history must read from there (invariant:
-    // all content comes from the .jsonl). `agentTranscriptHome` is the one answer.
-    const transcriptHome = agentTranscriptHome(user);
+    // all content comes from the .jsonl). `agentStateHome` is the one answer.
+    const transcriptHome = agentStateHome(user);
     // Resumed sessions start with what the transcript already consumed.
     const seededUsage = scanUsage(sessionFilePath(cwd, id, transcriptHome));
     const backend = sessionBackend(profile, group);
@@ -6176,9 +6236,11 @@ wss.on("connection", (ws, req) => {
                         }
                         return m ?? null;
                     };
+                    // The drop user a NEW spawn will run as — same inputs as the isolation
+                    // resolution further down. Hoisted out of the MT-token guard because the
+                    // worktree below must land in (and be owned by) this same user's home.
+                    let earlyUser = null;
                     if (!resumed) {
-                        // A new spawn has no stored group; same inputs as the isolation
-                        // resolution further down.
                         const earlyIso = resolveSpawnIsolation({
                             mode: DEPLOYMENT_MODE,
                             resumed,
@@ -6187,15 +6249,22 @@ wss.on("connection", (ws, req) => {
                             storedGroupId: null,
                             requestedGroupId: typeof msg.group === "string" && msg.group.trim() ? msg.group.trim() : null,
                         });
-                        const earlyUser = earlyIso.user ?? commonsOsUser({ migrated: groupsMigrated, mode: DEPLOYMENT_MODE });
+                        earlyUser = earlyIso.user ?? commonsOsUser({ migrated: groupsMigrated, mode: DEPLOYMENT_MODE });
                         const earlyMsg = mtRefusal(earlyUser);
                         if (earlyMsg)
                             return fail(earlyMsg);
                     }
                     if (msg.worktree && !resumed && isGitRepo(cwd)) {
                         try {
-                            worktree = createWorktree(cwd, id.slice(0, 8));
+                            // Create the checkout under the DROP USER's own home (not the
+                            // server's `/root`, which that user cannot traverse) and hand it to
+                            // them, so a dropped agent — notably every Tweak agent — can
+                            // actually work in it instead of landing on the invalid-settings
+                            // screen. `agentStateHome(null)` is the server home, so mono-tenant
+                            // is byte-for-byte unchanged.
+                            worktree = createWorktree(cwd, id.slice(0, 8), agentStateHome(earlyUser));
                             effectiveCwd = worktree.path;
+                            await chownAgentStateToDropUser(worktree.path, earlyUser);
                         }
                         catch (e) {
                             return fail("worktree creation failed: " + (e instanceof Error ? e.message : String(e)));