alissa-tools-github-devloop 0.8.23__tar.gz → 0.8.25__tar.gz

{alissa_tools_github_devloop-0.8.23/src/main/alissa_tools_github_devloop.egg-info → alissa_tools_github_devloop-0.8.25}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: alissa-tools-github-devloop
-Version: 0.8.23
+Version: 0.8.25
 Summary: ALISSA-TOOLS-GITHUB-DEVLOOP
 Home-page: https://alissa.app
 Author: Fahera

alissa_tools_github_devloop-0.8.25/src/main/alissa/tools/github/devloop/hubs.py

@@ -0,0 +1,427 @@
+"""Hub trust: keeping Claude Code's per-directory "trust this folder?" gate
+pre-accepted for every directory a dev session may start in (issue #123).
+
+Claude Code asks, once per directory, whether the folder it was started in is
+trusted -- and `--dangerously-skip-permissions` does NOT suppress that
+dialog. A headless session that meets it hangs: the directive `alissa tmux
+queue` types into the pane is swallowed by the prompt, the session sits in
+the roster reading ALIVE, and the daemon's liveness discipline (correctly)
+declines to respawn over a listed session. Observed 2026-09-16 on
+`dark-devloop-shared`: 108 minutes on `ali-fhr/docs.alissa.app#10`, until an
+operator accepted the dialog by hand.
+
+The container entrypoint seeds the gate at boot for the hubs it can NAME at
+boot: `{root}/{basename}` for every entry in `ALISSA_DEV_REPOS`, plus every
+hub already on disk. Under `repos_source: bows` `ALISSA_DEV_REPOS` is empty
+-- the allowlist is DERIVED from the feed Bodies of Work at runtime -- so a
+repo hub-ified after boot was never trusted. This module closes that gap
+from the daemon's side, in three places the loop calls:
+
+* after every successful feed refresh: the derived list is written to
+  `{root}/.alissa-derived-repos` (`DERIVED_REPOS_FILENAME`) so the NEXT boot's
+  entrypoint seeding can read it, and the derived hubs are trusted right
+  away, hub-ified or not (trusting a path that does not exist yet is exactly
+  what the entrypoint already does for the static allowlist);
+* at hub-ify time and before every spawn (`DevWatcher._ensure_hub`): the hub
+  root, `{hub}/main`, and every `{hub}/TASK-*` worktree on disk;
+* after a first-run-dialog wedge kill: the hub the wedged session started in,
+  so the re-enqueued attempt does not meet the same prompt.
+
+The merge is the entrypoint's, transposed: load-then-update of
+`~/.claude.json` and `$CLAUDE_CONFIG_DIR/.claude.json` (when set --
+`CLAUDE_CONFIG_DIR` reliably relocates only the credential file, so both
+targets are written and whichever claude reads carries the flag), only ever
+ADDING `projects[<path>].hasTrustDialogAccepted = true`. Idempotent: a target
+that already carries every entry is not rewritten at all, which is also what
+keeps the daemon's writes off a file Claude Code itself rewrites -- the only
+time this module touches the file is when a NEW directory has to be
+trusted. That write is guarded on three sides, because Claude Code itself
+rewrites the same file while sessions run (`_trust_hub` runs before EVERY
+spawn, and the `TASK-*` glob makes most of those writes real ones): the
+temp-file + rename keeps a concurrent READER from ever seeing a torn file;
+a compare-and-swap immediately before the rename (the file must still hold
+the bytes the merge was computed from) keeps the OTHER WRITER's update
+from being discarded wholesale -- the payload is the whole file, so a lost
+update could drop another session's `projects` entries or the persisted
+login; and a re-read after the rename catches a writer that landed right
+after ours and dropped OUR entries. Either miss restarts the merge on top
+of the newer file, a bounded number of times, and giving up is one WARNING.
+Never raises: trust is a convenience for the session about to spawn, and a
+failed write is one WARNING, never a lost poll.
+"""
+
+from __future__ import annotations
+
+import json
+import logging
+import os
+import re
+from pathlib import Path
+from typing import Iterable, Sequence
+
+log = logging.getLogger(__name__)
+
+# The file the daemon writes the derived (bows-mode) allowlist to, under the
+# workspace root, one `owner/repo` per line -- and the file the entrypoint's
+# first-run seeding reads at the NEXT boot (`ALISSA_DERIVED_REPOS_FILE`
+# overrides the location on both sides).
+DERIVED_REPOS_FILENAME = ".alissa-derived-repos"
+ENV_DERIVED_REPOS_FILE = "ALISSA_DERIVED_REPOS_FILE"
+
+# The state file Claude Code keeps its per-directory trust in, relative to
+# $HOME and to $CLAUDE_CONFIG_DIR.
+CLAUDE_STATE_FILENAME = ".claude.json"
+ENV_CLAUDE_CONFIG_DIR = "CLAUDE_CONFIG_DIR"
+TRUST_KEY = "hasTrustDialogAccepted"
+
+# What a pane PARKED on one of Claude Code's first-run gates shows -- and
+# what corroborates that it is parked there rather than merely mentioning
+# it (PR #124 review round 1). The gates' words are quoted by this repo's
+# README, CHANGELOG, this module and issue #123, so a session that cats any
+# of them, greps the tree or shows its own diff has them on screen while at
+# work -- and a match kills the session. The classifier therefore asks for
+# the gate's SHAPE, not its vocabulary (see `pane_shows_first_run_dialog`):
+#
+# * the gate's ACCEPT option (`FIRST_RUN_DIALOG_OPTIONS`) is one of the last
+#   `FIRST_RUN_DIALOG_TAIL_LINES` non-blank lines of the capture, once the
+#   selection cursor, option numbering and box drawing are stripped;
+# * nothing follows it but the gate's own chrome (`FIRST_RUN_DIALOG_CHROME`):
+#   a session that printed ANYTHING after the text -- a spinner, a tool
+#   call, the `>` input prompt an idle session sits at, a shell prompt --
+#   is not on the gate;
+# * the gate's QUESTION (`FIRST_RUN_DIALOG_MARKERS`) appears at or above
+#   the option line.
+#
+# The trust dialog reads "Quick safety check: Is this a project you created
+# or one you trust? … ❯ No, exit / Yes, I trust this folder"; the
+# bypass-permissions gate reads "WARNING: Claude Code running in Bypass
+# Permissions mode … No, exit / Yes, I accept" (either option order, with
+# or without numbering, an optional "Enter to confirm · Esc to exit" footer
+# and box drawing). Both are gates the entrypoint's seeding is meant to
+# pre-answer, so a pane parked on either is a session the seeding missed,
+# not a session at work.
+FIRST_RUN_DIALOG_MARKERS = (
+    "trust this folder",
+    "bypass permissions mode",
+)
+FIRST_RUN_DIALOG_OPTIONS = (
+    "yes, i trust this folder",
+    "yes, i accept",
+)
+FIRST_RUN_DIALOG_CHROME = (
+    "no, exit",
+    "enter to confirm",
+)
+FIRST_RUN_DIALOG_TAIL_LINES = 6
+
+# What a gate draws AROUND its text: box drawing, the selection cursor and
+# whitespace (stripped from both ends of a line), then "1." / "2)" option
+# numbering. Nothing else is stripped -- a diff's `+`, a markdown bullet,
+# a quote's backtick and the `>` of Claude Code's input prompt all stay,
+# which is what keeps a line that merely quotes a gate from reading as one.
+_DIALOG_DECORATION = "❯ \t│┃║╭╮╰╯┌┐└┘├┤┬┴┼─━═"
+_DIALOG_NUMBERING = re.compile(r"^\d+[.)]\s*")
+
+# How many times `seed_trust` restarts a merge that another writer moved
+# the file under (see the module docstring) before it gives up with a
+# WARNING. Claude Code's own rewrites are bursts around a session's start
+# and end, not a stream, so a second pass is expected to land.
+SEED_TRUST_ATTEMPTS = 3
+
+# The wedge classification the loop logs and records for a stale session
+# whose pane shows one of those gates.
+WEDGE_FIRST_RUN_DIALOG = "wedged:first-run-dialog"
+
+
+def claude_state_targets(
+    home: "Path | str | None" = None, config_dir: "Path | str | None" = None
+) -> "list[Path]":
+    """The `.claude.json` files to merge trust into: `$HOME/.claude.json`,
+    plus `$CLAUDE_CONFIG_DIR/.claude.json` when that variable is set and
+    non-blank. Both arguments default to the environment (`~` expansion
+    honours `HOME`), which is what lets a test point the merge at scratch
+    directories without touching the daemon's own files."""
+    home_dir = Path(home) if home is not None else Path(os.path.expanduser("~"))
+    targets = [home_dir / CLAUDE_STATE_FILENAME]
+    raw = (
+        str(config_dir)
+        if config_dir is not None
+        else os.environ.get(ENV_CLAUDE_CONFIG_DIR, "")
+    ).strip()
+    if raw:
+        extra = Path(raw) / CLAUDE_STATE_FILENAME
+        if extra != targets[0]:
+            targets.append(extra)
+    return targets
+
+
+def hub_trust_paths(hub: "Path | str") -> "list[Path]":
+    """Every directory a session on this hub may START in: the hub root
+    (where develop/fix/maintain sessions are spawned), `{hub}/main`, and each
+    `{hub}/TASK-*` worktree already on disk (a retried or resumed attempt may
+    be started inside a surviving worktree). The root and `main` are listed
+    whether or not they exist yet -- the point of seeding is to be there
+    BEFORE the directory is used."""
+    root = Path(hub)
+    paths = [root, root / "main"]
+    try:
+        worktrees = sorted(
+            p for p in root.glob("TASK-*") if p.is_dir()
+        )
+    except OSError:
+        worktrees = []
+    paths.extend(worktrees)
+    return paths
+
+
+def _load_state(path: Path) -> "tuple[str | None, dict]":
+    """The state file's raw text (None when absent) and its parsed object
+    (`{}` when absent or not a JSON object). Only ABSENCE is folded into
+    "start fresh": an unparseable file raises `ValueError` up to
+    `seed_trust`, which skips that target rather than replacing it (a
+    corrupt state file is never silently overwritten). The raw text is what
+    `_write_atomic` compares against before its rename."""
+    try:
+        with open(path, encoding="utf-8") as fh:
+            raw = fh.read()
+    except FileNotFoundError:
+        return None, {}
+    data = json.loads(raw)
+    return raw, (data if isinstance(data, dict) else {})
+
+
+def _raw_text(path: Path) -> "str | None":
+    try:
+        return path.read_text(encoding="utf-8")
+    except FileNotFoundError:
+        return None
+
+
+def _write_atomic(path: Path, data: dict, expected: "str | None") -> bool:
+    """Write `data` over `path` by temp file + rename -- unless the file no
+    longer holds `expected` (the raw text the caller merged from), in which
+    case nothing is replaced and False is returned so the caller merges
+    again on top of whoever wrote in between. The rename keeps READERS
+    safe (never a torn file); the check before it keeps the OTHER WRITER's
+    update safe, down to the gap between the check and the rename."""
+    path.parent.mkdir(parents=True, exist_ok=True)
+    tmp = path.with_name(path.name + ".tmp")
+    with open(tmp, "w", encoding="utf-8") as fh:
+        json.dump(data, fh, indent=2)
+        fh.write("\n")
+    if _raw_text(path) != expected:
+        tmp.unlink(missing_ok=True)
+        return False
+    os.replace(tmp, path)
+    return True
+
+
+def _add_trust(state: dict, wanted: "list[str]") -> "list[str]":
+    """Merge `projects[<path>].hasTrustDialogAccepted = true` for every
+    wanted path into `state` (in place, repairing a missing or non-object
+    `projects`). Returns the paths that were NOT already trusted."""
+    projects = state.get("projects")
+    if not isinstance(projects, dict):
+        projects = {}
+        state["projects"] = projects
+    added = []
+    for p in wanted:
+        entry = projects.get(p)
+        if not isinstance(entry, dict):
+            entry = {}
+            projects[p] = entry
+        if entry.get(TRUST_KEY) is not True:
+            entry[TRUST_KEY] = True
+            added.append(p)
+    return added
+
+
+def _untrusted(state: dict, wanted: "list[str]") -> "list[str]":
+    projects = state.get("projects")
+    if not isinstance(projects, dict):
+        return list(wanted)
+    return [
+        p for p in wanted
+        if not isinstance(projects.get(p), dict)
+        or projects[p].get(TRUST_KEY) is not True
+    ]
+
+
+def _merge_target(target: Path, wanted: "list[str]") -> bool:
+    """Merge `wanted` into ONE claude state file. True when the file was
+    written. Load, merge, compare-and-swap, verify -- and start over, up to
+    SEED_TRUST_ATTEMPTS times, whenever another writer moved the file
+    between the load and the rename (the swap refuses) or right after the
+    rename (the verify finds an entry missing). Never raises."""
+    wrote = False
+    for _ in range(SEED_TRUST_ATTEMPTS):
+        try:
+            raw, state = _load_state(target)
+        except (OSError, ValueError) as exc:
+            if wrote:
+                # Our write landed; whoever replaced it since left something
+                # this daemon will not touch. Nothing more to do here.
+                log.debug("trust: %s unreadable after the merge (%s)", target, exc)
+                return True
+            log.warning(
+                "trust: could not read %s (%s) — leaving it untouched; the "
+                "directories are NOT pre-trusted there: %s",
+                target, exc, ", ".join(wanted),
+            )
+            return False
+        added = _add_trust(state, wanted)
+        if not added:
+            # Every entry is present: it always was, or the pass before
+            # this one landed and survived.
+            return wrote
+        try:
+            swapped = _write_atomic(target, state, raw)
+        except OSError as exc:
+            log.warning(
+                "trust: could not write %s (%s) — the directories are NOT "
+                "pre-trusted there: %s", target, exc, ", ".join(added),
+            )
+            return wrote
+        if not swapped:
+            log.info(
+                "trust: %s changed underneath the merge — merging %s again "
+                "on top of the newer file", target, ", ".join(added),
+            )
+            continue
+        wrote = True
+        try:
+            _, after = _load_state(target)
+        except (OSError, ValueError) as exc:
+            log.debug("trust: %s unreadable right after the merge (%s)", target, exc)
+            return True
+        missing = _untrusted(after, wanted)
+        if not missing:
+            log.debug("trust: %s now pre-trusts %s", target, ", ".join(added))
+            return True
+        log.info(
+            "trust: %s was rewritten right after the merge and lost %s — "
+            "merging again", target, ", ".join(missing),
+        )
+    log.warning(
+        "trust: gave up merging into %s after %d attempts — another writer "
+        "kept rewriting it, so the directories may NOT be pre-trusted there: %s",
+        target, SEED_TRUST_ATTEMPTS, ", ".join(wanted),
+    )
+    return wrote
+
+
+def seed_trust(
+    paths: "Iterable[Path | str]",
+    *,
+    home: "Path | str | None" = None,
+    config_dir: "Path | str | None" = None,
+) -> "list[Path]":
+    """Merge `projects[<path>].hasTrustDialogAccepted = true` for every path
+    into every claude state target. Returns the targets that were WRITTEN
+    (a target already carrying every entry is left untouched -- byte for
+    byte, no rewrite). Never raises and never removes anything: an
+    unparseable target is skipped with a WARNING rather than replaced, a
+    failed write is a WARNING too, and a target another writer keeps
+    moving under the merge is retried a bounded number of times (see
+    `_merge_target` and the module docstring) before that, too, is one
+    WARNING.
+
+    Paths are recorded as absolute strings, which is how Claude Code keys
+    them; a relative path is resolved against the cwd, which is never what a
+    caller means, so callers pass absolute hubs."""
+    wanted = [os.fspath(Path(p)) for p in paths]
+    changed: "list[Path]" = []
+    if not wanted:
+        return changed
+    for target in claude_state_targets(home, config_dir):
+        if _merge_target(target, wanted):
+            changed.append(target)
+    return changed
+
+
+def derived_repos_path(root: "Path | str") -> Path:
+    """Where the derived allowlist is written under this workspace root, or
+    wherever `ALISSA_DERIVED_REPOS_FILE` points (the same override the
+    entrypoint honours, so an operator relocating one relocates both)."""
+    override = os.environ.get(ENV_DERIVED_REPOS_FILE, "").strip()
+    if override:
+        return Path(override)
+    return Path(root) / DERIVED_REPOS_FILENAME
+
+
+def write_derived_repos(root: "Path | str", repos: "Sequence[str]") -> "Path | None":
+    """Record the derived allowlist, one `owner/repo` per line, for the next
+    boot's entrypoint seeding. Rewritten only when the content differs.
+    Returns the path written, or None when nothing changed or the write
+    failed (logged; never raised -- the daemon has already trusted the hubs
+    itself, so this file only matters to a future boot)."""
+    path = derived_repos_path(root)
+    body = "".join(f"{r}\n" for r in repos)
+    try:
+        if path.is_file() and path.read_text(encoding="utf-8") == body:
+            return None
+        path.parent.mkdir(parents=True, exist_ok=True)
+        tmp = path.with_name(path.name + ".tmp")
+        tmp.write_text(body, encoding="utf-8")
+        os.replace(tmp, path)
+    except OSError as exc:
+        log.warning(
+            "could not record the derived allowlist at %s (%s) — the next "
+            "boot's entrypoint seeding will not pre-trust these hubs until a "
+            "refresh succeeds: %s", path, exc, ", ".join(repos),
+        )
+        return None
+    return path
+
+
+def read_derived_repos(root: "Path | str") -> "tuple[str, ...]":
+    """The recorded derived allowlist (`owner/repo` per line; blank lines and
+    `#` comments ignored), or `()` when absent or unreadable."""
+    path = derived_repos_path(root)
+    try:
+        text = path.read_text(encoding="utf-8")
+    except OSError:
+        return ()
+    out = []
+    for line in text.splitlines():
+        line = line.strip()
+        if line and not line.startswith("#") and "/" in line:
+            out.append(line)
+    return tuple(out)
+
+
+def _dialog_line(line: str) -> str:
+    """A pane line reduced to the text a gate would render there (see
+    _DIALOG_DECORATION), casefolded."""
+    text = line.strip(_DIALOG_DECORATION)
+    text = _DIALOG_NUMBERING.sub("", text).strip(_DIALOG_DECORATION)
+    return text.casefold()
+
+
+def _is_dialog_chrome(text: str) -> bool:
+    return any(text.startswith(chrome) for chrome in FIRST_RUN_DIALOG_CHROME)
+
+
+def pane_shows_first_run_dialog(pane: str) -> bool:
+    """Whether a session's terminal tail is PARKED on one of Claude Code's
+    first-run gates: the gate's accept option among the last
+    FIRST_RUN_DIALOG_TAIL_LINES non-blank lines, nothing but the gate's own
+    chrome below it, and the gate's question at or above it (the notes on
+    FIRST_RUN_DIALOG_MARKERS say why each leg is there). An empty capture
+    (the CLI could not tail) is never a dialog -- absence of evidence keeps
+    the defer -- and neither is a pane that merely MENTIONS a gate: a
+    session at work or idle at its prompt has printed something below the
+    words, and that something is not the gate's chrome."""
+    if not pane:
+        return False
+    lines = [t for t in (_dialog_line(ln) for ln in pane.splitlines()) if t]
+    tail = lines[-FIRST_RUN_DIALOG_TAIL_LINES:]
+    for offset in range(len(tail) - 1, -1, -1):
+        if any(tail[offset].startswith(o) for o in FIRST_RUN_DIALOG_OPTIONS):
+            break
+    else:
+        return False
+    if not all(_is_dialog_chrome(t) for t in tail[offset + 1:]):
+        return False
+    above = lines[:len(lines) - len(tail) + offset + 1]
+    return any(m in t for t in above for m in FIRST_RUN_DIALOG_MARKERS)

{alissa_tools_github_devloop-0.8.23 → alissa_tools_github_devloop-0.8.25}/src/main/alissa/tools/github/devloop/loop.py

@@ -442,6 +442,14 @@ from . import loop_events as loop_events_mod
 from .alissa import Alissa
 from .alissa_client import AlissaClient
 from .bows import BowRepoSource
+from .hubs import (
+    FIRST_RUN_DIALOG_MARKERS,
+    WEDGE_FIRST_RUN_DIALOG,
+    hub_trust_paths,
+    pane_shows_first_run_dialog,
+    seed_trust,
+    write_derived_repos,
+)
 from .config import (
     FOREIGN_IGNORE,
     FOREIGN_REAP,
@@ -716,6 +724,24 @@ _BRANCH_RULE = (
     "maintenance and no resume until an operator renames it. "
 )
 
+# The shell rule (issue #125). Workers run unattended under
+# `--dangerously-skip-permissions`, and Claude Code's critical-path removal
+# check STILL prompts on an rm whose target it cannot resolve statically (a
+# glob, a variable, a path outside the cwd) -- the dialog that wedged #107 for
+# seven hours. The container's PreToolUse guard refuses those shapes with a
+# reason; this rule tells the worker up front so it never writes them, and
+# never retries one the guard refused. In EVERY directive -- issue, resume,
+# fix, fix-resume, maintain -- because every one of them runs the same shell.
+_SHELL_RULE = (
+    "You are unattended: nothing can answer an interactive prompt. Never run "
+    "rm/rmdir on a glob, a shell variable or a path outside your worktree — "
+    "use literal paths, `find <dir> -mindepth 1 -delete` or `git clean -fdx "
+    "-- <path>`; never start an interactive command (editors, pagers, `git "
+    "rebase -i`, `npm init`, anything that asks y/n — pass the "
+    "non-interactive flag). If a command is refused by the shell guard, "
+    "change the command; do not retry it. "
+)
+
 DEV_DIRECTIVE = (
     "You are an IMPLEMENTER, not a reviewer. Implement GitHub issue "
     "{issue_url} (attempt {attempt} of {cap}) — the issue is your "
@@ -729,6 +755,7 @@ DEV_DIRECTIVE = (
     "task = one branch = one worktree; never clone, never work directly on "
     "main). "
     + _BRANCH_RULE
+    + _SHELL_RULE
     + "Implement to the issue's acceptance criteria and VERIFY locally (run the "
     "repo's test/style/type scripts) before publishing. Open a DRAFT PR whose "
     "body contains `Closes #{number}` and BOTH task refs — the origin task "
@@ -792,6 +819,7 @@ RESUME_DIRECTIVE = (
     "anchors. Keep the PR body carrying `Closes #{number}` and BOTH task refs "
     "(the origin task AND your implementation task) — restoring them if the "
     "dead session did not. "
+    + _SHELL_RULE
     + _RESUME_DELIVERY_NOTE
     + " "
     "If the PR already carries review findings, the ORDER is load-bearing: "
@@ -845,6 +873,7 @@ FIX_DIRECTIVE = (
     "EXISTING name (never a new branch, never a rename, never a clone, never "
     "main). "
     + _BRANCH_RULE
+    + _SHELL_RULE
     + "FIRST verify the triage of every prior review finding per CR8: exactly "
     "one reasoned `[triage:*]` reply on each finding's thread — post any that "
     "are missing. Then fix the pursued findings on the same branch and VERIFY "
@@ -899,6 +928,7 @@ FIX_RESUME_DIRECTIVE = (
     "that branch under its EXISTING name: never a new branch, never a "
     "rename, never a clone, never main, and NEVER a second PR. "
     + _BRANCH_RULE
+    + _SHELL_RULE
     + "The dead session may have posted SOME of its CR8 triage replies already: "
     "read every finding's thread and post exactly the ones that are missing — "
     "one reasoned `[triage:*]` reply per finding, NEVER a duplicate on a "
@@ -946,6 +976,7 @@ MAINTAIN_DIRECTIVE = (
     "EXISTING name (never a new branch, never a rename, never a clone, never "
     "main). "
     + _BRANCH_RULE
+    + _SHELL_RULE
     + "FIRST the idempotent no-op check: if the branch is already conflict-free "
     "AND current vs origin/main, remove the `{label}` label from the PR "
     "(`gh pr edit {number} --remove-label \"{label}\"`) and exit — push "
@@ -1258,6 +1289,16 @@ ESCALATION_LIVE_STALLED = "live-stalled"
 # poll is the remedy, not a bug.
 ESCALATION_WEDGED = "wedged"
 
+# The first-run-dialog wedge's once-per-episode marker (issue #123; see
+# first_run_dialog_kind). Like ESCALATION_WEDGED an ACT, not a page: the
+# daemon killed a session whose pane showed one of Claude Code's first-run
+# gates, seeded the trust the gate was asking for, and re-enqueued the
+# attempt itself. The row dedupes the WARNING (one per episode -- a kill
+# that fails and is retried next poll logs its retry at INFO) and the
+# activity-comment line; the loop-events emitter turns it into the generic
+# `escalation.first-run-dialog`, anchored on the issue.
+ESCALATION_FIRST_RUN_DIALOG = "first-run-dialog"
+
 # The maintenance edge's cap-out kind prefix. The `maintain-` prefix keeps
 # rows from ever colliding with the issue edge's `cap` when an issue and a
 # PR share a number; the epoch suffix is maintain_cap_kind's job below.
@@ -1614,6 +1655,17 @@ def wedge_kind(attempt: int) -> str:
     return f"{ESCALATION_WEDGED}:a{attempt}"
 
 
+def first_run_dialog_kind(attempt: int) -> str:
+    """The ledger kind for ONE first-run-dialog wedge episode (issue #123).
+
+    wedge_kind's episode reasoning: every attempt can meet the dialog (a
+    hub trusted after attempt k spawned is trusted for attempt k+1, but a
+    seeding that failed to land leaves the next attempt on the same prompt),
+    and attempt k's row must not silence attempt k+1's WARNING.
+    """
+    return f"{ESCALATION_FIRST_RUN_DIALOG}:a{attempt}"
+
+
 def deferral_activity_kind(session: str) -> str:
     """The activity-log kind that dedupes ONE capacity-deferral episode's line.
 
@@ -2408,6 +2460,12 @@ MANAGED_SESSION_PREFIX = "ali-"
 # pane said "Nothing left -- the review task is done.").
 FOREIGN_PANE_TAIL_LINES = 20
 
+# How many pane lines the first-run-dialog check reads (issue #123). The
+# trust dialog is a ~12-line box and the bypass-permissions gate ~20; a
+# session sitting on either has printed nothing since, so the last 40 lines
+# hold the whole prompt with room for the banner above it.
+FIRST_RUN_PANE_TAIL_LINES = 40
+
 # NOTE on where that capture goes: NOT onto the operator-facing line. The tail
 # is untrusted third-party terminal content and the console serves the log over
 # HTTP, so only its SHAPE (a line count) reaches WARNING and the transcript
@@ -2860,6 +2918,7 @@ class DevWatcher:
         # terminal one.
         resume_pr: "PullRequest | None" = None
         dead_session: "str | None" = None
+        wedged_dialog = False
         if age is not None:
             # `exhaustive` only when a resume could actually fire: the probe's
             # default early break answers the boolean the deferral needs, but
@@ -2983,6 +3042,25 @@ class DevWatcher:
                 # successful listing without this name) -- so the retry below
                 # can name the session it proved gone instead of presuming.
                 dead_session = live_session
+                if liveness is Liveness.ALIVE:
+                    # Issue #123: ALIVE is a process, not a worker. A session
+                    # sitting on Claude Code's first-run "trust this folder?"
+                    # (or bypass-permissions) gate is listed, idle, and will
+                    # never publish anything -- the directive typed into the
+                    # pane was swallowed by the prompt. Only on ALIVE (a
+                    # successful listing naming the row), and only when the
+                    # pane SHOWS the gate: every other alive-but-idle case
+                    # keeps the floored defer below, exactly as before.
+                    if self._wedged_on_first_run_dialog(
+                        issue, attempts, live_session
+                    ):
+                        wedged_dialog = True
+                        # The kill landed and the hub is seeded: fall through
+                        # to the cap check and the re-enqueue below as the
+                        # CONFIRMED-dead path would -- one WARNING for the
+                        # episode was logged by the classifier, so the
+                        # respawn's own line is suppressed.
+                        liveness = Liveness.DEAD
                 if liveness is not Liveness.DEAD:
                     # Floored exactly like the linked-PR deferral, and needing
                     # it for the same reason: this sits ABOVE the cap check,
@@ -3036,7 +3114,7 @@ class DevWatcher:
                 dead_session,
                 attempts + 1,
             )
-        elif age is not None:
+        elif age is not None and not wedged_dialog:
             log.warning(
                 "%s attempt %d has been in flight %.0f min with no completion "
                 "and no linked open PR, and its session %s is absent from the "
@@ -3581,6 +3659,132 @@ class DevWatcher:
             return None
         return min(youngest, max(0.0, now - committed))
 
+    def _wedged_on_first_run_dialog(
+        self, issue: Issue, attempts: int, session: str
+    ) -> bool:
+        """Issue #123: is this stale, ALIVE, PR-less session sitting on one of
+        Claude Code's first-run gates -- and if so, clear the lane.
+
+        Reads the pane (`alissa tmux tail`, the reaper's own evidence seam)
+        and asks `hubs.pane_shows_first_run_dialog` whether the session is
+        PARKED on a gate -- the gate's accept option among the last lines
+        with nothing but the gate's own chrome below it, its question
+        above -- not merely whether the gate's words appear: this repo's
+        own README, CHANGELOG, `hubs.py` and issue #123 quote them, so a
+        session that cats or diffs any of them has them on screen while at
+        work, and a kill here lands on the lane's own worktree. A pane not
+        parked on a gate, or one the CLI could not capture, answers False
+        and the caller keeps the floored defer it always took (runbook
+        caveat C7's other alive-but-idle causes -- expired OAuth, usage
+        limits, any other permission prompt -- are deliberately NOT
+        classified here).
+
+        A match is `wedged:first-run-dialog`: ONE WARNING per episode (keyed
+        first_run_dialog_kind(attempts) in the escalations ledger; a kill
+        that fails and is retried next poll logs at INFO), then the row's
+        own session is killed (`alissa tmux kill <name>`, never a sweep),
+        the hub it started in is trusted (root, main/, worktrees -- the very
+        entries the gate was asking for, so the retry does not meet it
+        again), one activity-comment line records the act, and True tells
+        the caller to re-enqueue as attempt k+1 NOW, counting toward
+        attempt_cap like any stale retry -- and on the TERMINAL attempt the
+        caller's cap check refuses that re-enqueue and pages the operator
+        instead, which is what the WARNING, the activity line and the
+        dry-run line say when `attempts >= attempt_cap`, rather than
+        promising a retry the lane will not get. Dry-run classifies and logs but
+        kills nothing and answers False (the defer holds). A kill that
+        fails answers False too: the defer holds and the next poll, reading
+        the same pane, tries again -- the remedy for a session that will not
+        die, not a loop to guard against.
+
+        The pane is untrusted third-party terminal content: only its
+        CLASSIFICATION reaches the log (see `_foreign_pane_evidence` for why
+        the capture itself stays at DEBUG)."""
+        pane = self.alissa.tail_session(session, FIRST_RUN_PANE_TAIL_LINES)
+        if not pane_shows_first_run_dialog(pane):
+            return False
+        log.debug(
+            "%s: last %d pane lines of %s:\n%s",
+            WEDGE_FIRST_RUN_DIALOG, FIRST_RUN_PANE_TAIL_LINES, session, pane,
+        )
+        hub = self.config.hub_for(issue.owner, issue.repo)
+        kind = first_run_dialog_kind(attempts)
+        # What the caller does with a True: the cap check sits right after
+        # this probe, so the terminal attempt caps out instead of retrying.
+        capping = attempts >= self.config.attempt_cap
+        if capping:
+            outcome = (
+                f"NOT re-enqueuing: attempt {attempts} was the last "
+                f"(attempt_cap {self.config.attempt_cap}), so the lane caps "
+                f"out and pages the operator"
+            )
+            activity_outcome = (
+                f"attempt_cap {self.config.attempt_cap} reached — the lane "
+                f"caps out and pages the operator instead of re-enqueuing"
+            )
+        else:
+            outcome = (
+                f"re-enqueuing as attempt {attempts + 1} (counting toward "
+                f"attempt_cap {self.config.attempt_cap})"
+            )
+            activity_outcome = f"re-enqueued as attempt {attempts + 1}"
+        if self.state.escalated(issue.full_name, issue.number, kind):
+            log.info(
+                "%s: session %s (%s attempt %d) is still on the claude "
+                "first-run dialog — retrying the kill",
+                WEDGE_FIRST_RUN_DIALOG, session, issue.issue_slug, attempts,
+            )
+        else:
+            log.warning(
+                "%s: session %s (%s attempt %d) reads alive but its pane shows "
+                "claude's first-run dialog (%s) — the directive was swallowed "
+                "by the prompt and nothing will ever be published. Killing "
+                "it, pre-trusting %s (root, main/, TASK-* worktrees) for "
+                "claude, and %s. Operator lever: `alissa tmux tail <session>` "
+                "to see the prompt, `tmux send-keys Down Enter` to accept it "
+                "by hand, or kill + seed as the daemon does",
+                WEDGE_FIRST_RUN_DIALOG, session, issue.issue_slug, attempts,
+                " / ".join(repr(m) for m in FIRST_RUN_DIALOG_MARKERS), hub,
+                outcome,
+            )
+            self.state.record_escalation(issue.full_name, issue.number, kind)
+        if self.config.dry_run:
+            log.info(
+                "[dry-run] would kill %s, pre-trust %s and %s",
+                session, hub,
+                f"cap out (attempt_cap {self.config.attempt_cap})" if capping
+                else f"re-enqueue attempt {attempts + 1}",
+            )
+            return False
+        try:
+            self.alissa.kill_session(session)
+        except CommandError as exc:
+            log.warning(
+                "%s: could not kill %s (%s) — kills are best-effort; the lane "
+                "keeps its defer and the kill is retried next poll",
+                WEDGE_FIRST_RUN_DIALOG, session, exc,
+            )
+            return False
+        self._trust_hub(hub, WEDGE_FIRST_RUN_DIALOG)
+        if not self.state.activity_logged(issue.full_name, issue.number, kind):
+            landed = self._append_activity(
+                issue.owner,
+                issue.repo,
+                issue.number,
+                self._activity_line(
+                    session,
+                    "issue edge",
+                    f"{ACTIVITY_WEDGE_KILLED} — {WEDGE_FIRST_RUN_DIALOG}: the "
+                    f"session read alive but its pane sat on claude's first-run "
+                    f"dialog (the hub was not pre-trusted); killed, hub {hub} "
+                    f"pre-trusted, {activity_outcome}",
+                ),
+                issue.issue_slug,
+            )
+            if landed:
+                self.state.record_activity(issue.full_name, issue.number, kind)
+        return True
+
     def _kill_wedged(
         self,
         issue: Issue,
@@ -6560,6 +6764,12 @@ class DevWatcher:
         full_name = f"{owner}/{repo}"
         hub = self.config.hub_for(owner, repo)
         if hub.is_dir():
+            # An existing hub may have grown TASK-* worktrees since boot (a
+            # session creates its own), and a hub that appeared between
+            # boots was never seeded by the entrypoint at all: trust is
+            # re-asserted before EVERY spawn. Idempotent and cheap -- a
+            # state file already carrying every path is not rewritten.
+            self._trust_hub(hub, "before spawn")
             return hub, None
 
         if self.config.on_missing_hub != HUB_ADD:
@@ -6600,8 +6810,39 @@ class DevWatcher:
                 f"success but {hub} still does not exist — check hub_template "
                 f"against the manifest's `dir:` override"
             )
+        # Issue #123: the entrypoint pre-trusts only the hubs it can name at
+        # boot, and under `repos_source: bows` a hub created here was never
+        # among them -- the first session on it hung on Claude Code's "trust
+        # this folder?" dialog for 108 minutes (ali-fhr/docs.alissa.app#10).
+        # Seed the hub root (the spawn cwd), main/ and any worktree BEFORE
+        # the session is enqueued.
+        self._trust_hub(hub, "hub-ified")
         return hub, None
 
+    def _trust_hub(self, hub: Path, why: str) -> "list[Path]":
+        """Pre-accept Claude Code's trust dialog for every directory a
+        session on this hub may start in (see `hubs.hub_trust_paths`), in
+        both claude state files. Returns the state files that changed.
+        Dry-run seeds nothing. Best-effort by construction (`seed_trust`
+        never raises): a session can still be spawned into an untrusted hub
+        -- it just may wedge on the dialog, which the stale-session branch
+        now detects -- so a failed seed must never cost the spawn."""
+        paths = hub_trust_paths(hub)
+        if self.config.dry_run:
+            log.info(
+                "[dry-run] would pre-trust %d claude dir(s) for hub %s (%s)",
+                len(paths), hub, why,
+            )
+            return []
+        changed = seed_trust(paths)
+        if changed:
+            log.info(
+                "trusted hub %s for claude (%s): %d dir(s) — %s — written to %s",
+                hub, why, len(paths), ", ".join(str(p) for p in paths),
+                ", ".join(str(t) for t in changed),
+            )
+        return changed
+
     # -- the derived allowlist (repos_source: "bows") ----------------------
 
     def _apply_repos(self, repos: "tuple[str, ...]") -> None:
@@ -6692,6 +6933,36 @@ class DevWatcher:
             )
             return
         self._apply_repos(source.repos())
+        self._record_derived(source.derived)
+
+    def _record_derived(self, derived: "tuple[str, ...]") -> None:
+        """Issue #123: make the derived allowlist visible to the entrypoint's
+        boot-time trust seeding (`{root}/.alissa-derived-repos`) and trust
+        the derived hubs NOW -- hub-ified or not, exactly as the entrypoint
+        trusts a static allowlist's hubs before they exist. Both are
+        best-effort and idempotent; dry-run writes nothing."""
+        if not derived:
+            return
+        if self.config.dry_run:
+            log.info(
+                "[dry-run] would record %d derived repo(s) and pre-trust "
+                "their hubs", len(derived),
+            )
+            return
+        write_derived_repos(self.config.workspace_root, derived)
+        paths: "list[Path]" = []
+        for full_name in derived:
+            owner, _, repo = full_name.partition("/")
+            if not owner or not repo:
+                continue
+            paths.extend(hub_trust_paths(self.config.hub_for(owner, repo)))
+        changed = seed_trust(paths)
+        if changed:
+            log.info(
+                "repos_source=bows: pre-trusted the hubs of %d derived "
+                "repo(s) for claude in %s",
+                len(derived), ", ".join(str(t) for t in changed),
+            )
 
     # -- preflight ---------------------------------------------------------
 

{alissa_tools_github_devloop-0.8.23 → alissa_tools_github_devloop-0.8.25}/src/main/alissa/tools/github/devloop/loop_events.py

@@ -127,7 +127,9 @@ _FOREIGN_RE = re.compile(r"^foreign-session:(.+)$")
 # lane is working, not the draft PR behind it) -- PR and issue numbers share
 # GitHub's namespace, so a kind missing here does not merely mislabel, it
 # points the operator at an unrelated PR or at nothing.
-_ISSUE_ANCHORED = ("cap", "assignment", "stalled", "live-stalled", "wedged")
+_ISSUE_ANCHORED = (
+    "cap", "assignment", "stalled", "live-stalled", "wedged", "first-run-dialog",
+)
 
 
 def _ms(ts: "int | float | str") -> int:

alissa_tools_github_devloop-0.8.25/src/main/alissa/tools/github/devloop/version

@@ -0,0 +1 @@
+0.8.25

{alissa_tools_github_devloop-0.8.23 → alissa_tools_github_devloop-0.8.25/src/main/alissa_tools_github_devloop.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: alissa-tools-github-devloop
-Version: 0.8.23
+Version: 0.8.25
 Summary: ALISSA-TOOLS-GITHUB-DEVLOOP
 Home-page: https://alissa.app
 Author: Fahera

{alissa_tools_github_devloop-0.8.23 → alissa_tools_github_devloop-0.8.25}/src/main/alissa_tools_github_devloop.egg-info/SOURCES.txt

@@ -12,6 +12,7 @@ src/main/alissa/tools/github/devloop/bows.py
 src/main/alissa/tools/github/devloop/config.py
 src/main/alissa/tools/github/devloop/fleet_vitals.py
 src/main/alissa/tools/github/devloop/ghclient.py
+src/main/alissa/tools/github/devloop/hubs.py
 src/main/alissa/tools/github/devloop/janitor.py
 src/main/alissa/tools/github/devloop/loop.py
 src/main/alissa/tools/github/devloop/loop_events.py

alissa_tools_github_devloop-0.8.23/src/main/alissa/tools/github/devloop/version

@@ -1 +0,0 @@
-0.8.23