shadok-ai 0.17.8 → 0.17.10

package/README.md

@@ -501,6 +501,16 @@ across OS users (Claude rewrites the credential single-owner on refresh), which
 is why each user logs in separately. Design:
 `docs/superpowers/specs/2026-11-04-connectors-via-global-login-design.md`.
 
+**Persist the group homes (recommended in Docker).** Each dropped agent runs as
+its own OS user with HOME under `SHADOK_HOME_BASE` (default `/home`), which is
+**not** on the `shadok-data` volume by default — so a `docker rm` + recreate
+wipes those homes, taking their Claude first-run/trust state (agents briefly land
+on the "trust this folder" dialog until it is re-seeded) and, in **login** mode,
+the per-user credentials (every user has to log in again). shadok re-seeds the
+trust robustly on boot, but to avoid the churn entirely mount the home base on a
+volume, the same move as the SSH key (below): e.g. add `-v shadok-homes:/home` to
+the `docker run`. A plain restart never needed this; only a recreate does.
+
 Telegram stays single-owner, and there are no
 disk quotas yet. Design: `docs/superpowers/specs/2026-10-29-multi-tenant-scoped-isolation-design.md`.
 

package/dist/claude-home.d.ts

@@ -39,6 +39,23 @@ export declare function seedPlan(existing: ClaudeHome, opts: {
     version: string;
     cwd?: string;
 }): ClaudeHome | null;
+/**
+ * Pure: the object to write after trusting EVERY cwd in `cwds` (plus the
+ * globals), or null when nothing is missing.
+ *
+ * This is `seedPlan` folded over many directories so a shared group HOME is
+ * seeded in ONE atomic write instead of one racy write per spawn. The
+ * motivating bug: N agents share a single `~/.claude.json`, and rebuilding it
+ * one cwd at a time during a boot respawn storm let a sibling `claude`'s stale
+ * write clobber a trust entry before that agent's own process read it —
+ * stranding it on the "trust this folder" dialog. Seeding the complete set up
+ * front (before any such process starts) removes the window entirely. Each
+ * `cwd` keeps `seedPlan`'s additive, never-overwrite discipline.
+ */
+export declare function seedPlanForCwds(existing: ClaudeHome, opts: {
+    version: string;
+    cwds: readonly string[];
+}): ClaudeHome | null;
 export interface ClaudeSettings {
     tui?: string;
     [k: string]: unknown;

package/dist/claude-home.js

@@ -124,6 +124,35 @@ export function seedPlan(existing, opts) {
     }
     return changed ? out : null;
 }
+/**
+ * Pure: the object to write after trusting EVERY cwd in `cwds` (plus the
+ * globals), or null when nothing is missing.
+ *
+ * This is `seedPlan` folded over many directories so a shared group HOME is
+ * seeded in ONE atomic write instead of one racy write per spawn. The
+ * motivating bug: N agents share a single `~/.claude.json`, and rebuilding it
+ * one cwd at a time during a boot respawn storm let a sibling `claude`'s stale
+ * write clobber a trust entry before that agent's own process read it —
+ * stranding it on the "trust this folder" dialog. Seeding the complete set up
+ * front (before any such process starts) removes the window entirely. Each
+ * `cwd` keeps `seedPlan`'s additive, never-overwrite discipline.
+ */
+export function seedPlanForCwds(existing, opts) {
+    let current = existing;
+    let changed = false;
+    // Globals first (no cwd), then each directory — threading the running object
+    // so every change lands in one result. seedPlan returns null for "nothing to
+    // add", in which case we keep the object we already have.
+    const steps = [undefined, ...opts.cwds];
+    for (const cwd of steps) {
+        const next = seedPlan(current, { version: opts.version, cwd });
+        if (next) {
+            current = next;
+            changed = true;
+        }
+    }
+    return changed ? current : null;
+}
 /**
  * Pure: `~/.claude/settings.json` after adding the keys that suppress a
  * first-run *upsell*, or null when nothing is missing.

package/dist/claude-home.js.map

@@ -1 +1 @@
-{"version":3,"file":"claude-home.js","sourceRoot":"","sources":["../src/claude-home.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAiC7B,yDAAyD;AACzD,MAAM,qBAAqB,GAAG,CAAC,+BAA+B,CAAU,CAAC;AAEzE,4EAA4E;AAC5E,MAAM,UAAU,kBAAkB,CAAC,MAAc;IAC/C,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;IACrD,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACzB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CACtB,QAAoB,EACpB,IAAuC;IAEvC,MAAM,GAAG,GAAe,EAAE,GAAG,QAAQ,EAAE,CAAC;IACxC,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,KAAc,EAAE,EAAE;QAC1C,IAAI,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC;YAClB,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACjB,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;IACH,CAAC,CAAC;IACF,0EAA0E;IAC1E,4EAA4E;IAC5E,4EAA4E;IAC5E,0EAA0E;IAC1E,GAAG,CAAC,wBAAwB,EAAE,IAAI,CAAC,CAAC;IACpC,GAAG,CAAC,uBAAuB,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAE3C,yEAAyE;IACzE,4EAA4E;IAC5E,kDAAkD;IAClD,EAAE;IACF,yEAAyE;IACzE,4EAA4E;IAC5E,0EAA0E;IAC1E,mEAAmE;IACnE,2EAA2E;IAC3E,0DAA0D;IAC1D,oEAAoE;IACpE,+EAA+E;IAC/E,0EAA0E;IAC1E,6EAA6E;IAC7E,2EAA2E;IAC3E,kEAAkE;IAClE,8DAA8D;IAC9D,wEAAwE;IACxE,iCAAiC;IACjC,4EAA4E;IAC5E,4EAA4E;IAC5E,6EAA6E;IAC7E,sDAAsD;IACtD,EAAE;IACF,uEAAuE;IACvE,4EAA4E;IAC5E,6EAA6E;IAC7E,EAAE;IACF,sEAAsE;IACtE,2EAA2E;IAC3E,wEAAwE;IACxE,EAAE;IACF,yEAAyE;IACzE,yEAAyE;IACzE,6EAA6E;IAC7E,oEAAoE;IACpE,wEAAwE;IACxE,GAAG,CAAC,uBAAuB,EAAE,IAAI,CAAC,CAAC;IAEnC,0EAA0E;IAC1E,2EAA2E;IAC3E,2EAA2E;IAC3E,mEAAmE;IACnE,EAAE;IACF,mEAAmE;IACnE,yEAAyE;IACzE,oEAAoE;IACpE,EAAE;IACF,qEAAqE;IACrE,2EAA2E;IAC3E,4EAA4E;IAC5E,6EAA6E;IAC7E,8EAA8E;IAC9E,mCAAmC;IACnC,EAAE;IACF,yEAAyE;IACzE,0EAA0E;IAC1E,qCAAqC;IACrC,MAAM,GAAG,GAAG,EAAE,GAAG,CAAE,QAAQ,CAAC,gBAAwD,IAAI,EAAE,CAAC,EAAE,CAAC;IAC9F,IAAI,CAAC,CAAC,WAAW,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,aAAa,IAAI,GAAG,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC;QACrB,GAAG,CAAC,gBAAgB,GAAG,GAAG,CAAC;QAC3B,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IAED,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,MAAM,QAAQ,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC;QAClD,MAAM,KAAK,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QAChD,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,gEAAgE;QAChE,EAAE;QACF,4EAA4E;QAC5E,uEAAuE;QACvE,0EAA0E;QAC1E,0EAA0E;QAC1E,6EAA6E;QAC7E,IAAI,KAAK,CAAC,sBAAsB,KAAK,IAAI,EAAE,CAAC;YAC1C,KAAK,CAAC,sBAAsB,GAAG,IAAI,CAAC;YACpC,YAAY,GAAG,IAAI,CAAC;QACtB,CAAC;QACD,sEAAsE;QACtE,KAAK,MAAM,GAAG,IAAI,qBAAqB,EAAE,CAAC;YACxC,IAAI,CAAC,CAAC,GAAG,IAAI,KAAK,CAAC,EAAE,CAAC;gBACpB,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;gBAClB,YAAY,GAAG,IAAI,CAAC;YACtB,CAAC;QACH,CAAC;QACD,IAAI,YAAY,EAAE,CAAC;YACjB,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YAC3B,GAAG,CAAC,QAAQ,GAAG,QAAQ,CAAC;YACxB,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9B,CAAC;AAOD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,YAAY,CAAC,QAAwB;IACnD,IAAI,KAAK,IAAI,QAAQ;QAAE,OAAO,IAAI,CAAC,CAAC,0CAA0C;IAC9E,0EAA0E;IAC1E,2EAA2E;IAC3E,iCAAiC;IACjC,OAAO,EAAE,GAAG,QAAQ,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC;AAC5C,CAAC;AAED,MAAM,QAAQ,GAAG,GAAW,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,cAAc,CAAC,CAAC;AACvE,MAAM,YAAY,GAAG,GAAW,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;AAEvF,4DAA4D;AAC5D,SAAS,aAAa;IACpB,IAAI,CAAC;QACH,OAAO,CACL,kBAAkB,CAAC,YAAY,CAAC,aAAa,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,OAAO,CAClG,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,QAAQ,CAAC,IAAY;IAC5B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QACzD,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IACxF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,SAAS,CAAC,IAAY,EAAE,IAAgB;IAC/C,MAAM,GAAG,GAAG,GAAG,IAAI,WAAW,OAAO,CAAC,GAAG,MAAM,CAAC;IAChD,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,0EAA0E;AAC1E,SAAS,IAAI,CAAC,GAAY;IACxB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;QACxB,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,0EAA0E;YAC1E,wEAAwE;YACxE,oCAAoC;YACpC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,8DAA8D,CAAC,CAAC;YAChG,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QACnE,IAAI,IAAI;YAAE,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,0EAA0E;QAC1E,8DAA8D;QAC9D,OAAO,CAAC,GAAG,CAAC,iCAAiC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC7F,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,gBAAgB;IAC9B,IAAI,EAAE,CAAC;IACP,YAAY,EAAE,CAAC;AACjB,CAAC;AAED,+EAA+E;AAC/E,SAAS,YAAY;IACnB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;QAC5B,IAAI,QAAQ,GAA0B,EAAE,CAAC;QACzC,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;gBACzD,QAAQ;oBACN,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;YACnF,CAAC;YAAC,MAAM,CAAC;gBACP,QAAQ,GAAG,IAAI,CAAC,CAAC,mDAAmD;YACtE,CAAC;QACH,CAAC;QACD,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO;QAC9B,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,MAAM,GAAG,GAAG,GAAG,IAAI,WAAW,OAAO,CAAC,GAAG,MAAM,CAAC;QAChD,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACrD,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,iCAAiC;IACnC,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,IAAI,CAAC,GAAG,CAAC,CAAC;AACZ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,eAAe;IAC7B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,EAAE,MAAM,CAAC,CAAC;QACpD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC;QACjC,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,eAAe,CAAC,KAAoB;IAClD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;QAC5B,IAAI,QAAQ,GAAmB,EAAE,CAAC;QAClC,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;YACzD,yEAAyE;YACzE,mEAAmE;YACnE,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBAAE,OAAO,KAAK,CAAC;YACjF,QAAQ,GAAG,MAAM,CAAC;QACpB,CAAC;QACD,MAAM,IAAI,GAAmB,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7C,IAAI,KAAK,EAAE,IAAI,EAAE;YAAE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;;YACxC,OAAO,IAAI,CAAC,KAAK,CAAC;QACvB,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,MAAM,GAAG,GAAG,GAAG,IAAI,WAAW,OAAO,CAAC,GAAG,MAAM,CAAC;QAChD,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACrD,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}
+{"version":3,"file":"claude-home.js","sourceRoot":"","sources":["../src/claude-home.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAiC7B,yDAAyD;AACzD,MAAM,qBAAqB,GAAG,CAAC,+BAA+B,CAAU,CAAC;AAEzE,4EAA4E;AAC5E,MAAM,UAAU,kBAAkB,CAAC,MAAc;IAC/C,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;IACrD,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACzB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CACtB,QAAoB,EACpB,IAAuC;IAEvC,MAAM,GAAG,GAAe,EAAE,GAAG,QAAQ,EAAE,CAAC;IACxC,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,KAAc,EAAE,EAAE;QAC1C,IAAI,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC;YAClB,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACjB,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;IACH,CAAC,CAAC;IACF,0EAA0E;IAC1E,4EAA4E;IAC5E,4EAA4E;IAC5E,0EAA0E;IAC1E,GAAG,CAAC,wBAAwB,EAAE,IAAI,CAAC,CAAC;IACpC,GAAG,CAAC,uBAAuB,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAE3C,yEAAyE;IACzE,4EAA4E;IAC5E,kDAAkD;IAClD,EAAE;IACF,yEAAyE;IACzE,4EAA4E;IAC5E,0EAA0E;IAC1E,mEAAmE;IACnE,2EAA2E;IAC3E,0DAA0D;IAC1D,oEAAoE;IACpE,+EAA+E;IAC/E,0EAA0E;IAC1E,6EAA6E;IAC7E,2EAA2E;IAC3E,kEAAkE;IAClE,8DAA8D;IAC9D,wEAAwE;IACxE,iCAAiC;IACjC,4EAA4E;IAC5E,4EAA4E;IAC5E,6EAA6E;IAC7E,sDAAsD;IACtD,EAAE;IACF,uEAAuE;IACvE,4EAA4E;IAC5E,6EAA6E;IAC7E,EAAE;IACF,sEAAsE;IACtE,2EAA2E;IAC3E,wEAAwE;IACxE,EAAE;IACF,yEAAyE;IACzE,yEAAyE;IACzE,6EAA6E;IAC7E,oEAAoE;IACpE,wEAAwE;IACxE,GAAG,CAAC,uBAAuB,EAAE,IAAI,CAAC,CAAC;IAEnC,0EAA0E;IAC1E,2EAA2E;IAC3E,2EAA2E;IAC3E,mEAAmE;IACnE,EAAE;IACF,mEAAmE;IACnE,yEAAyE;IACzE,oEAAoE;IACpE,EAAE;IACF,qEAAqE;IACrE,2EAA2E;IAC3E,4EAA4E;IAC5E,6EAA6E;IAC7E,8EAA8E;IAC9E,mCAAmC;IACnC,EAAE;IACF,yEAAyE;IACzE,0EAA0E;IAC1E,qCAAqC;IACrC,MAAM,GAAG,GAAG,EAAE,GAAG,CAAE,QAAQ,CAAC,gBAAwD,IAAI,EAAE,CAAC,EAAE,CAAC;IAC9F,IAAI,CAAC,CAAC,WAAW,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,aAAa,IAAI,GAAG,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC;QACrB,GAAG,CAAC,gBAAgB,GAAG,GAAG,CAAC;QAC3B,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IAED,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,MAAM,QAAQ,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC;QAClD,MAAM,KAAK,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QAChD,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,gEAAgE;QAChE,EAAE;QACF,4EAA4E;QAC5E,uEAAuE;QACvE,0EAA0E;QAC1E,0EAA0E;QAC1E,6EAA6E;QAC7E,IAAI,KAAK,CAAC,sBAAsB,KAAK,IAAI,EAAE,CAAC;YAC1C,KAAK,CAAC,sBAAsB,GAAG,IAAI,CAAC;YACpC,YAAY,GAAG,IAAI,CAAC;QACtB,CAAC;QACD,sEAAsE;QACtE,KAAK,MAAM,GAAG,IAAI,qBAAqB,EAAE,CAAC;YACxC,IAAI,CAAC,CAAC,GAAG,IAAI,KAAK,CAAC,EAAE,CAAC;gBACpB,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;gBAClB,YAAY,GAAG,IAAI,CAAC;YACtB,CAAC;QACH,CAAC;QACD,IAAI,YAAY,EAAE,CAAC;YACjB,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YAC3B,GAAG,CAAC,QAAQ,GAAG,QAAQ,CAAC;YACxB,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9B,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,eAAe,CAC7B,QAAoB,EACpB,IAAkD;IAElD,IAAI,OAAO,GAAG,QAAQ,CAAC;IACvB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,6EAA6E;IAC7E,6EAA6E;IAC7E,0DAA0D;IAC1D,MAAM,KAAK,GAA8B,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IACnE,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/D,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AAClC,CAAC;AAOD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,YAAY,CAAC,QAAwB;IACnD,IAAI,KAAK,IAAI,QAAQ;QAAE,OAAO,IAAI,CAAC,CAAC,0CAA0C;IAC9E,0EAA0E;IAC1E,2EAA2E;IAC3E,iCAAiC;IACjC,OAAO,EAAE,GAAG,QAAQ,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC;AAC5C,CAAC;AAED,MAAM,QAAQ,GAAG,GAAW,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,cAAc,CAAC,CAAC;AACvE,MAAM,YAAY,GAAG,GAAW,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;AAEvF,4DAA4D;AAC5D,SAAS,aAAa;IACpB,IAAI,CAAC;QACH,OAAO,CACL,kBAAkB,CAAC,YAAY,CAAC,aAAa,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,OAAO,CAClG,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,QAAQ,CAAC,IAAY;IAC5B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QACzD,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IACxF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,SAAS,CAAC,IAAY,EAAE,IAAgB;IAC/C,MAAM,GAAG,GAAG,GAAG,IAAI,WAAW,OAAO,CAAC,GAAG,MAAM,CAAC;IAChD,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,0EAA0E;AAC1E,SAAS,IAAI,CAAC,GAAY;IACxB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;QACxB,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,0EAA0E;YAC1E,wEAAwE;YACxE,oCAAoC;YACpC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,8DAA8D,CAAC,CAAC;YAChG,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QACnE,IAAI,IAAI;YAAE,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,0EAA0E;QAC1E,8DAA8D;QAC9D,OAAO,CAAC,GAAG,CAAC,iCAAiC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC7F,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,gBAAgB;IAC9B,IAAI,EAAE,CAAC;IACP,YAAY,EAAE,CAAC;AACjB,CAAC;AAED,+EAA+E;AAC/E,SAAS,YAAY;IACnB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;QAC5B,IAAI,QAAQ,GAA0B,EAAE,CAAC;QACzC,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;gBACzD,QAAQ;oBACN,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;YACnF,CAAC;YAAC,MAAM,CAAC;gBACP,QAAQ,GAAG,IAAI,CAAC,CAAC,mDAAmD;YACtE,CAAC;QACH,CAAC;QACD,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO;QAC9B,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,MAAM,GAAG,GAAG,GAAG,IAAI,WAAW,OAAO,CAAC,GAAG,MAAM,CAAC;QAChD,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACrD,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,iCAAiC;IACnC,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,IAAI,CAAC,GAAG,CAAC,CAAC;AACZ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,eAAe;IAC7B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,EAAE,MAAM,CAAC,CAAC;QACpD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC;QACjC,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,eAAe,CAAC,KAAoB;IAClD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;QAC5B,IAAI,QAAQ,GAAmB,EAAE,CAAC;QAClC,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;YACzD,yEAAyE;YACzE,mEAAmE;YACnE,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBAAE,OAAO,KAAK,CAAC;YACjF,QAAQ,GAAG,MAAM,CAAC;QACpB,CAAC;QACD,MAAM,IAAI,GAAmB,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7C,IAAI,KAAK,EAAE,IAAI,EAAE;YAAE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;;YACxC,OAAO,IAAI,CAAC,KAAK,CAAC;QACvB,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,MAAM,GAAG,GAAG,GAAG,IAAI,WAAW,OAAO,CAAC,GAAG,MAAM,CAAC;QAChD,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACrD,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/server.js

@@ -19,7 +19,7 @@ import { extractLiveText } from "../public/live-text.js";
 import { findTransientErrors, newTransientErrors, RETRY_DELAYS_MS } from "./retry.js";
 import { backgroundTasks, screenShowsWork, moveToOption } from "./detect.js";
 import { PtyPilot } from "./session.js";
-import { ensureClaudeHome, ensureProjectTrusted, getDefaultModel, setDefaultModel, parseClaudeVersion, seedPlan, settingsPlan, } from "./claude-home.js";
+import { ensureClaudeHome, ensureProjectTrusted, getDefaultModel, setDefaultModel, parseClaudeVersion, seedPlanForCwds, settingsPlan, } from "./claude-home.js";
 import { authStatus, cancelLogin, invalidateAuthStatus, startLogin, submitLoginCode } from "./claude-auth.js";
 import { startSetupToken, submitSetupTokenCode, cancelSetupToken } from "./setup-token.js";
 import { startAgentLogin, submitAgentLoginCode, cancelAgentLogin, agentLoginPending, agentLoginInfo, } from "./agent-login.js";
@@ -42,7 +42,7 @@ import { computePace, paceBlock, WINDOW_SEC } from "./pace.js";
 import { getUsage } from "./usage.js";
 import { loadChannels, loadGroups, saveGroups, normalizeGroups, ensureMainGroup, upsertChannel, removeChannel, mergeClientChannels, channelWriteAllowed, profilePatch, loadTgGroup, saveTgGroup, isHomeChannel, homeAdoptionTarget, resolveSessionTarget, resolveResumeId, resumeTarget, } from "./channels.js";
 import { deliverWithRetry } from "./reload.js";
-import { startTelegram, renameTelegramTopic, closeTelegramTopic, probeToken, isStalePreface, announceLoggedOut, resetLoggedOutNotice, attachmentPrompt, pasteFileName, MEDIA_DIR, } from "./telegram.js";
+import { startTelegram, renameTelegramTopic, closeTelegramTopic, probeToken, isStalePreface, announceLoggedOut, resetLoggedOutNotice, attachmentPrompt, pasteFileName, mediaDir, } from "./telegram.js";
 import { transcribe, audioClipExtension } from "./whisper.js";
 import { cancelPairingCode, issuePairingCode, pairingStatus } from "./tg-pairing.js";
 import { migrateTgBindings } from "./channels.js";
@@ -1377,8 +1377,9 @@ app.post("/paste", express.raw({ type: () => true, limit: PASTE_LIMIT }), (req,
     const name = decodeURIComponent(String(req.headers["x-filename"] ?? ""));
     const kind = contentType.trim().toLowerCase().startsWith("image/") ? "image" : "file";
     try {
-        fs.mkdirSync(MEDIA_DIR, { recursive: true });
-        const file = path.join(MEDIA_DIR, pasteFileName(randomUUID(), name, contentType));
+        const dir = mediaDir();
+        fs.mkdirSync(dir, { recursive: true });
+        const file = path.join(dir, pasteFileName(randomUUID(), name, contentType));
         fs.writeFileSync(file, body);
         // The very wording Telegram already uses, so an agent sees one format.
         res.json({ path: file, line: attachmentPrompt([{ path: file, kind }]) });
@@ -2246,6 +2247,51 @@ function channelStateHome(chan) {
 }
 /** Task 12: the one shared pot every group HOME links as `~/shared`. */
 const SHARED_POT_PATH = (process.env.SHADOK_SHARED_POT_PATH ?? "").trim() || DEFAULT_SHARED_POT_PATH;
+// Multi-tenant: Telegram/paste attachments must be readable by a privilege-
+// dropped agent, but the default `~/.shadok-ai/media` is `/root/.shadok-ai/media`
+// — and `/root` (mode 700) is un-traversable by the `main`/`sk-*` drop users, so
+// an agent handed `[Attached image: /root/.shadok-ai/media/…]` cannot open it
+// (invariant 54's family). Relocate media under the shared pot (which every drop
+// user is in `shadok-shared` to traverse), carry existing attachments over so
+// already-sent images keep resolving, and point `mediaDir()` there via the env.
+// Best-effort: a failure just leaves media at `~/.shadok-ai/media`, the old
+// (broken-for-agents) behaviour, never a boot failure. Mono-tenant is untouched.
+if (DEPLOYMENT_MODE === "multi-tenant") {
+    try {
+        const shared = path.join(SHARED_POT_PATH, "media");
+        fs.mkdirSync(shared, { recursive: true });
+        // Own it to the pot's group (`shadok-shared`) with setgid, so files the
+        // server writes inherit that group and the drop users can read them.
+        try {
+            const potGid = fs.statSync(SHARED_POT_PATH).gid;
+            fs.chownSync(shared, 0, potGid);
+            fs.chmodSync(shared, 0o2775);
+        }
+        catch {
+            /* pot not provisioned yet (pre-migration) — the next boot fixes it */
+        }
+        const legacy = path.join(os.homedir(), ".shadok-ai", "media");
+        if (legacy !== shared && fs.existsSync(legacy)) {
+            for (const name of fs.readdirSync(legacy)) {
+                const dst = path.join(shared, name);
+                if (!fs.existsSync(dst)) {
+                    try {
+                        fs.copyFileSync(path.join(legacy, name), dst);
+                    }
+                    catch {
+                        /* skip an unreadable/odd entry */
+                    }
+                }
+            }
+        }
+        process.env.SHADOK_MEDIA_DIR = shared;
+        console.log(`media: using ${shared} (reachable by dropped agents)`);
+    }
+    catch (e) {
+        console.warn("media: could not set up the shared media dir, keeping ~/.shadok-ai/media: " +
+            (e instanceof Error ? e.message : String(e)));
+    }
+}
 /** Run a privileged account command. Root runs it directly; otherwise go through
  *  NON-interactive sudo (`-n`) so a MISSING right fails fast with a non-zero exit
  *  instead of prompting — the T3 false positive (sudoers allows `true` but not
@@ -2525,6 +2571,10 @@ async function ensureGroupsProvisioned() {
     // invite-redeem hook nor the per-account migration loop ever fires for it.
     // Give it a Personal group here; idempotent (reuses an existing private group).
     await ensurePrivateGroupProvisioned(BOOTSTRAP_ADMIN);
+    // Before any agent comes back: fill every drop user's HOME with the full set
+    // of trusted directories in one write each, so none strands on the trust
+    // dialog when the resume storm rebuilds a wiped (ephemeral) group HOME.
+    preseedGroupHomes();
 }
 /** Step 1 — create the non-root commons user `main` (+ HOME). Idempotent. */
 async function migCreateCommonsUser() {
@@ -4289,8 +4339,9 @@ app.get("/download", (req, res) => {
 // same `nosniff` + `sandbox` CSP as /download neutralises an SVG opened directly.
 app.get("/media/:name", (req, res) => {
     const base = path.basename(String(req.params.name ?? ""));
-    const file = path.join(MEDIA_DIR, base);
-    if (!file.startsWith(path.join(MEDIA_DIR, path.sep)) && path.dirname(file) !== MEDIA_DIR) {
+    const dir = mediaDir();
+    const file = path.join(dir, base);
+    if (!file.startsWith(path.join(dir, path.sep)) && path.dirname(file) !== dir) {
         return res.status(400).type("text").send("bad name");
     }
     let stat;
@@ -4870,7 +4921,7 @@ function ensureAgentSshKey(user, home) {
  * seed the shadok SKILLS into the group HOME (they live only in the server's
  * ~/.claude/skills); that gap is tracked separately.
  */
-function seedGroupAgentHome(user, home, cwd) {
+function seedHomeTrust(user, home, cwds) {
     const version = currentClaudeVersion() ?? "0.0.0";
     const readObj = (file) => {
         const r = spawnAsUserSync(user, "cat", [file]);
@@ -4890,7 +4941,9 @@ function seedGroupAgentHome(user, home, cwd) {
         const homeJson = `${home}/.claude.json`;
         const existing = readObj(homeJson);
         if (existing) {
-            const plan = seedPlan(existing, { version, cwd });
+            // ONE write for the globals + every cwd (not one racy write per cwd) —
+            // see `seedPlanForCwds` and `preseedGroupHomes` for why that matters.
+            const plan = seedPlanForCwds(existing, { version, cwds });
             if (plan)
                 writeAsUserAtomic(user, homeJson, JSON.stringify(plan, null, 2));
         }
@@ -4909,6 +4962,75 @@ function seedGroupAgentHome(user, home, cwd) {
         console.log(`claude-home: could not seed group HOME ${home} — ${e instanceof Error ? e.message : String(e)}`);
     }
 }
+/**
+ * The drop user each channel's agent runs as, mapped to the directories that
+ * user's agents live in. The input to seeding a group HOME with the right set
+ * of trusted directories. Only DROP users appear (commons `main`, private
+ * `sk-*`); a public/mono channel runs as the server's own user (null), whose
+ * `/root` is handled by `ensureClaudeHome` + `ensureProjectTrusted` and lives
+ * on the shadok-data volume — it never suffers the ephemeral-rebuild race this
+ * map exists to close.
+ */
+function dropUserCwds() {
+    const out = new Map();
+    const groups = new Map(loadGroups().map((g) => [g.id, g]));
+    const commons = commonsOsUser({ migrated: groupsMigrated, mode: DEPLOYMENT_MODE });
+    const add = (user, cwd) => {
+        if (!user || !cwd)
+            return;
+        let s = out.get(user);
+        if (!s) {
+            s = new Set();
+            out.set(user, s);
+        }
+        s.add(cwd);
+    };
+    for (const ch of loadChannels()) {
+        const g = ch.group ? groups.get(ch.group) : undefined;
+        add((g ? osUserFor(g) : null) ?? commons, ch.cwd);
+    }
+    // The commons also runs the lead agent in the launch dir itself.
+    if (commons)
+        add(commons, process.cwd());
+    return out;
+}
+/**
+ * Seed a dropped agent's OWN HOME before it spawns — this agent's cwd AND every
+ * sibling cwd that shares the HOME, in ONE write. The shared `~/.claude.json`
+ * is read-modify-written by every agent in the HOME (commons agents all share
+ * `/home/main`), so rebuilding it one cwd at a time during a respawn storm let
+ * a stale sibling `claude` write clobber a trust entry before its owner read it
+ * — stranding that agent on the "trust this folder" dialog (invariant 23's
+ * family, on the group HOME). A complete write closes the window. See the file
+ * comment on `seedHomeTrust` / `preseedGroupHomes`. Runs AS the group user,
+ * SYNCHRONOUSLY and ADDITIVELY; best-effort.
+ */
+function seedGroupAgentHome(user, home, cwd) {
+    const cwds = new Set([cwd]);
+    const siblings = dropUserCwds().get(user);
+    if (siblings)
+        for (const c of siblings)
+            cwds.add(c);
+    seedHomeTrust(user, home, [...cwds]);
+}
+/**
+ * Boot pre-seed: seed EVERY drop user's HOME with its full set of trusted
+ * directories, in one atomic write each, BEFORE the resume/respawn storm — so a
+ * `claude` that starts in that storm always finds its cwd already trusted. The
+ * group HOMEs are not on the shadok-data volume, so a `docker` recreate wipes
+ * them and they are rebuilt from empty exactly when many agents come back at
+ * once; the per-spawn seed alone then raced (measured: an agent stuck on the
+ * trust dialog with its entry missing from the shared `/home/main/.claude.json`
+ * while `/root`'s — volume-backed — had it). Best-effort; mono-tenant or
+ * un-migrated → no drop users → no-op.
+ */
+function preseedGroupHomes() {
+    if (DEPLOYMENT_MODE !== "multi-tenant" || !groupsMigrated)
+        return;
+    for (const [user, cwds] of dropUserCwds()) {
+        seedHomeTrust(user, homeForUser(user, GROUP_HOME_BASE), [...cwds]);
+    }
+}
 function makePilot(id, cwd, args, profileName, model, effort, 
 /**
  * The OS user to drop this agent to (multi-tenant isolation, `src/osusers.ts`).