Merge remote-tracking branch 'origin/main' into auto/frame-blend-draw-path

docker/decoder/entrypoint.sh

@@ -156,7 +156,16 @@ mkdir -p /exchange/files 2>/dev/null || true
 #
 # Newer-wins rather than always-copy, because the container refreshes its own
 # token during a run and that copy may legitimately be the fresher one.
-if [ -d "$HOME/.claude.seed" ] && \
+# 🔴 A LONG-LIVED TOKEN WINS, AND THE SEEDING MUST NOT FIGHT IT.
+#
+# With CLAUDE_CODE_OAUTH_TOKEN set, copying the host's rotating credential file
+# in would re-create the exact collision the token exists to remove: three
+# clients on one rotating refresh token, the losers of a rotation race getting
+# their stored tokens CLEARED to empty strings and parking at "Login expired".
+# Measured 2026-09-04 -- see the launcher.
+if [ -n "${CLAUDE_CODE_OAUTH_TOKEN:-}" ]; then
+  log "auth: using the long-lived token from the environment; not seeding OAuth"
+elif [ -d "$HOME/.claude.seed" ] && \
    { [ ! -s "$HOME/.claude/.credentials.json" ] || \
      [ "$HOME/.claude.seed/.credentials.json" -nt "$HOME/.claude/.credentials.json" ]; }; then
   mkdir -p "$HOME/.claude"

docker/decoder/sylph-decoder

@@ -185,6 +185,33 @@ docker_args() {
   # Read-only, and only ever used by `push-work`, which refuses anything but an
   # auto/* branch and never force-pushes. Without this the agent's work only
   # exists inside the container and dies with it.
+  # ── Claude auth ──
+  #
+  # 🔴 THE ROTATING OAUTH FILE IS WHY THIS AGENT KEPT PARKING, and a long-lived
+  # token removes the failure by construction rather than recovering from it.
+  #
+  # Measured 2026-09-04: `~/.claude/.credentials.json` holds a REFRESH TOKEN THAT
+  # ROTATES ON USE. Seeding both containers from the host's copy left three
+  # clients holding one token; the first to refresh invalidated the other two,
+  # and on the failed refresh **Claude Code CLEARS the stored tokens** -- it
+  # writes empty strings, keeps the metadata, and parks at "Login expired". The
+  # decoder's file was caught emptied at 13:04:28 with its last work at 13:04:29.
+  # A hollow file passes every "does it exist" check, which is why three separate
+  # diagnoses missed it.
+  #
+  # `claude setup-token` issues a LONG-LIVED token against the same Claude
+  # subscription (not Console/API billing -- `claude auth login` defaults to
+  # `--claudeai`, and `--console` is the billed one). Passed as an environment
+  # variable it cannot be rotated out from under a peer and there is no file for
+  # Claude Code to empty, so both halves of the failure are gone.
+  #
+  # Inert until the file exists: without it the OAuth path below is unchanged.
+  CLAUDETOK="${SYLPH_CLAUDE_TOKEN:-$HOME/.sylph-claude-token}"
+  if [ -f "$CLAUDETOK" ]; then
+    _out+=(-e "CLAUDE_CODE_OAUTH_TOKEN=$(tr -d '[:space:]' < "$CLAUDETOK")")
+    echo "==> auth: long-lived token from $CLAUDETOK (no rotating credential file)" >&2
+  fi
+
   GITCRED="${SYLPH_GIT_CREDENTIALS:-$HOME/.sylph-git-credentials}"
   if [ -f "$GITCRED" ]; then
     _out+=(-v "$GITCRED:/sylph-home/re/.git-credentials.host:ro")

docker/port/entrypoint.sh

@@ -38,7 +38,14 @@ echo "[entrypoint] display $DISPLAY ready ($SCREEN_GEOMETRY)"
 #
 # Newer-wins rather than always-copy, because the container refreshes its own
 # token during a run and that copy may legitimately be the fresher one.
-if [ -d "$HOME/.claude.seed" ] && \
+# 🔴 A LONG-LIVED TOKEN WINS, AND THE SEEDING MUST NOT FIGHT IT. With
+# CLAUDE_CODE_OAUTH_TOKEN set, copying the host's rotating credential file in
+# would re-create the collision the token exists to remove: three clients on one
+# rotating refresh token, and the loser of a rotation race gets its stored tokens
+# CLEARED to empty strings by Claude Code and parks. Measured 2026-09-04.
+if [ -n "${CLAUDE_CODE_OAUTH_TOKEN:-}" ]; then
+  echo "[entrypoint] auth: long-lived token from the environment; not seeding OAuth"
+elif [ -d "$HOME/.claude.seed" ] && \
    { [ ! -s "$HOME/.claude/.credentials.json" ] || \
      [ "$HOME/.claude.seed/.credentials.json" -nt "$HOME/.claude/.credentials.json" ]; }; then
   mkdir -p "$HOME/.claude"

docker/port/sylph-port

@@ -105,6 +105,20 @@ docker_args() {
   # routinely wrong teaches the reader to ignore the one that is real. Mounting
   # rw would also silence it, but then the container can clobber the host's
   # credential file; copying cannot.
+  # ── Claude auth ──
+  # See the decoder's launcher for the full note. Short version: the OAuth
+  # credential file holds a refresh token that ROTATES ON USE, three clients were
+  # seeded from one copy, and the loser of a rotation race has its tokens CLEARED
+  # to empty strings by Claude Code and parks at "Login expired". A long-lived
+  # `claude setup-token` credential passed in the environment has nothing to
+  # rotate and no file to empty. Same subscription, not API billing.
+  # Inert until the file exists.
+  local claudetok="${SYLPH_CLAUDE_TOKEN:-$HOME/.sylph-claude-token}"
+  if [ -f "$claudetok" ]; then
+    _out+=(-e "CLAUDE_CODE_OAUTH_TOKEN=$(tr -d '[:space:]' < "$claudetok")")
+    echo "==> auth: long-lived token from $claudetok (no rotating credential file)" >&2
+  fi
+
   local gitcred="${SYLPH_GIT_CREDENTIALS:-$HOME/.sylph-git-credentials}"
   if [ -f "$gitcred" ]; then
     _out+=(-v "$gitcred:/sylph-home/port/.git-credentials.host:ro")