c58196b795
The last structural fix for the collision class that has bitten three times. Both containers now clone the repository into their OWN named volume instead of bind-mounting a human's working tree, so an agent's local git config cannot capture a human's commits, a credential helper cannot leak a container-only path onto the host, and a `git add -A` cannot sweep another party's in-flight files. Cloned once at startup and never auto-pulled: pulling under a running agent moves files out from under whatever it is mid-edit, which is the same bug again. Accepted knowingly: Claude Code keys per-project memory off the working directory, so moving off the host path starts that memory empty. The corpus in docs/ is the memory that matters and it travels with the clone. Other changes: * docker/agent -> docker/decoder; the launcher is sylph-decoder. Roles, not "the agent", now that there is more than one. * /reborn is gone -- one repository now, so the port reads HANDOFF from its own checkout rather than through a live read-only mount of someone else's tree. * Canary mounts separately at /canary; it stays a fork tracking upstream. * A shared `sylpheed-exchange` volume at /exchange, with tools/ on PATH so `share` is available in both. * The decoder's credential file gets the .host-copy treatment the port already had -- `credential.helper=store` rewrites by rename-over-target, which is EBUSY on a bind mount and reports a fatal that is not one. * Budget split deliberately: decoder 5 cpu / 6 GB, port 3 / 4, leaving room for the planned Referee. "Half the host" was right when there was one agent. Prompts move to docs/agents/ and are rewritten around the protocol: the oracle is the running game, dynamic RE stays with the decoder, each iteration must attempt to refute one claim of the other, and neither may verify its way out of its own role.
86 lines
3.5 KiB
Python
Executable File
86 lines
3.5 KiB
Python
Executable File
#!/usr/bin/env python3
|
|
"""Mark Claude Code's onboarding as complete in ~/.claude.json.
|
|
|
|
Claude Code re-runs its first-run wizard whenever `lastOnboardingVersion` does
|
|
not match the installed version. In a terminal that is a one-key prompt; for an
|
|
unattended agent it is a silent, permanent hang on the theme picker — no error,
|
|
no log line, and the container looks like it started fine.
|
|
|
|
It also pre-accepts the workspace's trust prompt. That is a SECOND, separate
|
|
first-run gate: even past onboarding, Claude Code asks "is this a project you
|
|
trust?" per directory, and this repo's settings pre-approve 442 tool permissions
|
|
so the prompt is emphatic about it. Unattended, it is another silent hang.
|
|
|
|
Pre-accepting is safe here precisely because the trust question is being
|
|
answered by the person who built and launched the container, for their own
|
|
repository — it is not a judgement being made on their behalf about someone
|
|
else's code.
|
|
|
|
Usage: seed-claude-config.py <path to .claude.json> <installed version> [workspace...]
|
|
"""
|
|
import json
|
|
import os
|
|
import sys
|
|
|
|
|
|
def main() -> int:
|
|
if len(sys.argv) < 3:
|
|
print(f"usage: {sys.argv[0]} <config.json> <version> [workspace...]",
|
|
file=sys.stderr)
|
|
return 2
|
|
path, version = sys.argv[1], sys.argv[2]
|
|
workspaces = sys.argv[3:]
|
|
|
|
cfg = {}
|
|
if os.path.exists(path) and os.path.getsize(path):
|
|
try:
|
|
with open(path) as f:
|
|
cfg = json.load(f)
|
|
except (OSError, ValueError):
|
|
# A corrupt or partial config is not worth failing the container
|
|
# over — start from empty rather than block the run.
|
|
cfg = {}
|
|
if not isinstance(cfg, dict):
|
|
cfg = {}
|
|
|
|
cfg["hasCompletedOnboarding"] = True
|
|
cfg["lastOnboardingVersion"] = version
|
|
cfg.setdefault("theme", "dark")
|
|
# The THIRD interactive gate: --dangerously-skip-permissions shows a
|
|
# "Bypass Permissions mode / you accept all responsibility" confirmation on
|
|
# first use. Key name taken from the shipped binary's own strings, not
|
|
# guessed. Accepting it here is the whole point of `sylph-agent loose` —
|
|
# the container is the sandbox that warning asks you to provide.
|
|
cfg["bypassPermissionsModeAccepted"] = True
|
|
# A FOURTH gate, and this one fires mid-session rather than at startup, so
|
|
# the pty wrapper has already handed over by then: an upsell asking whether
|
|
# to try the fullscreen renderer. It is shown while
|
|
# `fullscreenUpsellSeenCount` is below an internal threshold, so park it far
|
|
# above. Found by reading the shipped binary's strings, same as the others.
|
|
cfg["fullscreenUpsellSeenCount"] = 9999
|
|
# An auto-update mid-run would restart the process and lose the loop's
|
|
# scheduled wake-up, so pin the version the container was built with.
|
|
cfg["autoUpdates"] = False
|
|
|
|
projects = cfg.setdefault("projects", {})
|
|
if not isinstance(projects, dict):
|
|
projects = cfg["projects"] = {}
|
|
for ws in workspaces:
|
|
entry = projects.setdefault(ws, {})
|
|
if not isinstance(entry, dict):
|
|
entry = projects[ws] = {}
|
|
entry["hasTrustDialogAccepted"] = True
|
|
entry.setdefault("projectOnboardingSeenCount", 1)
|
|
entry["hasClaudeMdExternalIncludesApproved"] = True
|
|
entry["hasClaudeMdExternalIncludesWarningShown"] = True
|
|
|
|
tmp = path + ".tmp"
|
|
with open(tmp, "w") as f:
|
|
json.dump(cfg, f, indent=2)
|
|
os.replace(tmp, path)
|
|
return 0
|
|
|
|
|
|
if __name__ == "__main__":
|
|
sys.exit(main())
|