Triple-C

296 Commits 2 Branches 41 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
shadow-testandClaude Opus 5	0a022dfcf0	Let a project turn a globally-enabled Claude Code setting back off The six boolean settings were plain `bool`s merged with `if p.x { true } else { g.x }`, so a project could only ever add to the global set. There was no project value that produced `false` — turning a switch off at project level simply fell through to the global value and the control did nothing. Widen them to `Option<bool>`. `None` means "not set at this level": inherit the global on a project, leave Claude Code's own default alone globally. `Some(false)` is a deliberate off and wins outright. The fingerprint now formats with `{:?}` rather than `{}` — `None` and `Some(false)` mean different things, and conflating them would leave the container un-recreated when a project switched from inherit to off. The project editor grows a third "Global" state per switch; the global editor has nothing to inherit from, so it stays a plain toggle and keeps collapsing to null at the default. Its three existing tests passed unchanged and caught a first attempt that rendered unset as off, which would have told every user their session recap was disabled. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GBq2rGum6GX7xXgsas1fDc	2026-08-23 09:05:39 -07:00
shadow-testandClaude Opus 5	dd2894cc60	Stop Docker disk growth, and fix the Claude Code settings that never worked Two independent sets of fixes. ## Disk: stop the growth, no UI this round The dangling-snapshot sweep was already correct and was never the leak. The leak is that every `docker commit` stacks a layer and nothing compacts one: a file deleted after it has been committed becomes a whiteout, not free bytes. 24 conditions trigger recreation+commit, so changing one settings field costs a multi-gigabyte layer for the life of the project. One project was measured with 14 stacked commit layers, ~5.1 GB above its base. * Scrub the writable layer before every commit (`docker/container.rs`, `SNAPSHOT_SCRUB_PATHS` / `scrub_writable_layer`). The one moment those bytes are still free to drop is before the commit that captures them. Measured on one container's 4.48 GB pending layer: 3.0 GB of agent scratchpad under `/tmp/claude-`, the terminal drag-drop staging area (256 MiB per file, with no `rm` for it anywhere in the repo), a PNG per pasted image, and the apt lists/cache/logs that `browser_view/install.rs` and `triple-c-playwright-heal` leave behind with no `apt-get clean`. A hardcoded list, never a heuristic: `/workspace/{mount_name}` is a host bind mount and nothing here may reach one, and the three `/tmp` globs cannot select the read-only `.host-ca`/`.host-aws` mounts. Failure is a log line — a scrub must never block a snapshot. Cap container logs (`capped_log_config`). There was no `LogConfig` anywhere, so containers ran on the daemon's unbounded `json-file` default. Deliberately not wired into `container_needs_recreation`: participating would recreate every project once, and a recreation costs a commit, which is the thing being fixed. Picked up on the next natural recreation. * Make superseded base images sweepable (`container/Dockerfile`). It carried no `LABEL` at all, so `orphan_sweep_filters`' `dangling` + `triple-c.managed` pair provably could not match one — ~11.9 GB observed stranded. Stamping `triple-c.managed=true` is the whole fix; the sweep needed no change. `create_container` writes the new `triple-c.base` key explicitly empty, or Docker's label inheritance plus `docker commit` would make every snapshot claim to be a base image. `force: false` stays, and now says why. * Sweep at startup (`lib.rs`), not only after recreation: probes first (a probe pins an image the unforced sweep then refuses), pins second, sweep last. `sweep_orphaned_snapshots_logged` exists because all three callers threw the report away — `reclaimed_bytes`, `failed` and `unavailable` included. * Reap migration leftovers. `rollback_migration` retagged and orphaned the migrated snapshot with no sweep. Stale `pre-migration-` pins are now age-reaped by scanning the tag pattern rather than trusting the state file — `migration_store::load` reports an unparseable record as absent, which stranded a 4-12 GB pin nothing could name again; `load` now moves a corrupt record aside so `has_record` is trustworthy. A pin whose migration is still awaiting confirmation is never reaped at any age. The probe container's removal was a plain statement after an await, so a dropped future (an app quit mid-migration) leaked a container pinning a multi-gigabyte image; it is a `Drop` guard now, with `reap_probe_containers` for the case where the process itself dies. Prune scheduler logs. `remove` deleted a task's JSON but never its log directory, and the task runner appended uncapped `claude -p` output. * Fix the delete copy. It said "the container, config volume, and stored credentials"; it removes both volumes and the snapshot image. No prune UI, and no unfiltered `prune_images`/`prune_volumes` anywhere — the daemon is shared with the user's unrelated work. ## Claude Code settings: two invented keys, one inverted default, one sticky bug Verified against code.claude.com/docs/en/settings-reference.md and env-vars.md. * `effort` -> `effortLevel`, the key Claude Code actually reads; the old one was written and silently ignored. `xhigh` added to the dropdown. * `focusMode` -> `viewMode: "focus"`. `focusMode` was invented. The real key does exactly what the existing UI hint already described. * Session recap was inverted. Claude Code's recap is on by default, so `CLAUDE_CODE_ENABLE_AWAY_SUMMARY=1`-when-enabled was a no-op and the control could never turn the recap off. The field is renamed to `session_recap_disabled` rather than reused: reusing the name with the opposite meaning would have read every stored `enable_session_recap: false` — which is every project that never touched the control — as "the user turned this off". * The stickiness, which is the important one. Keys were emitted only when non-default, and the entrypoint merges into a settings.json on a persisted volume, so switching a setting off omitted its key, the merge preserved the stale on-value, and the setting stayed on until a destructive Reset. The fix already existed in the same file — the sandbox block is emitted unconditionally for exactly this reason — and is now applied to all five keys. A key whose neutral state is unset (`tui`, `effortLevel`, `viewMode`, `awaySummaryEnabled`) is emitted as JSON `null` and the entrypoint deletes it, because a stand-in value is not neutral: `tui: "default"` pins the classic renderer where unset lets Claude Code choose, and `viewMode: "default"` overrides the user's own sticky `/focus` choice. * The same stickiness existed, unnoticed, in the env vars: `docker commit` bakes container env into the snapshot image, so a `=1` written once rode it forever. All four are now emitted on every create, extracted into `claude_code_env_vars` and unit tested. Two use an empty value for "off" rather than `0`, because they outrank a setting the user can change from inside their own container and Triple-C's default must not overrule a `/config` choice it never asked about. * TUI mode is now a genuine three-way choice (automatic / classic / fullscreen), which the always-emitted key makes both necessary and possible. `merge_claude_code_settings` is untouched by choice: a project-level OFF still cannot override a globally-ON setting. Tests: 364 frontend (+5), 308 Rust (+23), covering the scrub path list and script, log rotation, pin reaping, and that toggling a setting off actually clears a previously-set ON value. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GBq2rGum6GX7xXgsas1fDc	2026-08-23 08:35:10 -07:00
shadow-testandClaude Opus 5	01a2f6aec8	Add Project Home, Auth Bridge, shared auth token, and Tier-1 polish Project Home (DESIGN-REVIEW §B2): the project is promoted from a 280px sidebar card to a first-class main-area view. ProjectCard.tsx (1,257 lines) is replaced by a select-only ProjectRow plus tabs for Overview, Sessions, Automation, Config and Files. The PortMappings, FileManager and ContainerProgress modals are absorbed rather than reimplemented. Config gains a Saved/Saving/Failed indicator — save-on-blur failures previously reached only console.error. Tier-1 polish (DESIGN-REVIEW §A): new elevation, muted-accent, disabled and focus-ring tokens; a global :focus-visible ring with every focus:outline-none removed; filled buttons moved to --accent-emphasis and white-on-success toggles retired, fixing three WCAG AA failures (2.1:1, 2.5:1, 2.4:1); a shared Modal primitive with role="dialog", focus trap and restore, adopted by all remaining modals; status indicators that carry a glyph and word rather than colour alone. Ctrl+Shift+W closes a tab, deliberately not Ctrl+W — that is readline's kill-word, used constantly in the terminal this app is built around. Auth Bridge: a general loopback-callback bridge so browser logins run inside a container (aws sso login, Concourse fly login, claude login) can complete against the host browser. Listeners are discovered from /proc/net/tcp{,6} — ss/netstat/lsof are absent from the image — bound on host 127.0.0.1 only, and tunnelled in over the Docker API via socat, which keeps working on Docker Desktop where container IPs are not routable. Falls back to [::1] because Node resolves localhost to IPv6 first, so claude login often binds ::1 alone. Opt-in per project. This extracts create_attached_exec() and moves the existing terminal session path onto it, so there is one attached-exec implementation rather than two. Shared auth token: `claude setup-token` is run in a container, the token is stored in the OS keychain and injected as CLAUDE_CODE_OAUTH_TOKEN into Anthropic-backend projects. Contrary to the initial design note, setup-token uses an Anthropic-hosted redirect and blocks on a stdin paste prompt rather than a loopback callback, so a stdin command is required for the flow to complete. The token is never logged, never returned to the frontend, and is redacted from the streamed output with a stateful matcher that withholds any tail that could still grow into a secret. Change detection uses a random rotation id rather than a hash, since a hash in a docker-inspect readable label would be an offline verification oracle. Frontend 33 -> 51 tests; Rust 34 tests. Both builds clean. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-09 11:35:42 -07:00

Author

SHA1

Message

Date

shadow-testandClaude Opus 5

0a022dfcf0

Let a project turn a globally-enabled Claude Code setting back off

The six boolean settings were plain `bool`s merged with
`if p.x { true } else { g.x }`, so a project could only ever add to the
global set. There was no project value that produced `false` — turning a
switch off at project level simply fell through to the global value and
the control did nothing.

Widen them to `Option<bool>`. `None` means "not set at this level":
inherit the global on a project, leave Claude Code's own default alone
globally. `Some(false)` is a deliberate off and wins outright.

The fingerprint now formats with `{:?}` rather than `{}` — `None` and
`Some(false)` mean different things, and conflating them would leave the
container un-recreated when a project switched from inherit to off.

The project editor grows a third "Global" state per switch; the global
editor has nothing to inherit from, so it stays a plain toggle and keeps
collapsing to null at the default. Its three existing tests passed
unchanged and caught a first attempt that rendered unset as off, which
would have told every user their session recap was disabled.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GBq2rGum6GX7xXgsas1fDc

2026-08-23 09:05:39 -07:00

shadow-testandClaude Opus 5

dd2894cc60

Stop Docker disk growth, and fix the Claude Code settings that never worked

Two independent sets of fixes.

## Disk: stop the growth, no UI this round

The dangling-snapshot sweep was already correct and was never the leak. The
leak is that every `docker commit` **stacks** a layer and nothing compacts one:
a file deleted after it has been committed becomes a whiteout, not free bytes.
24 conditions trigger recreation+commit, so changing one settings field costs a
multi-gigabyte layer for the life of the project. One project was measured with
14 stacked commit layers, ~5.1 GB above its base.

* **Scrub the writable layer before every commit** (`docker/container.rs`,
  `SNAPSHOT_SCRUB_PATHS` / `scrub_writable_layer`). The one moment those bytes
  are still free to drop is before the commit that captures them. Measured on
  one container's 4.48 GB pending layer: 3.0 GB of agent scratchpad under
  `/tmp/claude-*`, the terminal drag-drop staging area (256 MiB per file, with
  no `rm` for it anywhere in the repo), a PNG per pasted image, and the apt
  lists/cache/logs that `browser_view/install.rs` and `triple-c-playwright-heal`
  leave behind with no `apt-get clean`. A hardcoded list, never a heuristic:
  `/workspace/{mount_name}` is a host bind mount and nothing here may reach one,
  and the three `/tmp` globs cannot select the read-only `.host-ca`/`.host-aws`
  mounts. Failure is a log line — a scrub must never block a snapshot.

* **Cap container logs** (`capped_log_config`). There was no `LogConfig`
  anywhere, so containers ran on the daemon's unbounded `json-file` default.
  Deliberately *not* wired into `container_needs_recreation`: participating
  would recreate every project once, and a recreation costs a commit, which is
  the thing being fixed. Picked up on the next natural recreation.

* **Make superseded base images sweepable** (`container/Dockerfile`). It carried
  no `LABEL` at all, so `orphan_sweep_filters`' `dangling` + `triple-c.managed`
  pair provably could not match one — ~11.9 GB observed stranded. Stamping
  `triple-c.managed=true` is the whole fix; the sweep needed no change.
  `create_container` writes the new `triple-c.base` key explicitly empty, or
  Docker's label inheritance plus `docker commit` would make every snapshot
  claim to be a base image. `force: false` stays, and now says why.

* **Sweep at startup** (`lib.rs`), not only after recreation: probes first
  (a probe pins an image the unforced sweep then refuses), pins second, sweep
  last. `sweep_orphaned_snapshots_logged` exists because all three callers threw
  the report away — `reclaimed_bytes`, `failed` and `unavailable` included.

* **Reap migration leftovers.** `rollback_migration` retagged and orphaned the
  migrated snapshot with no sweep. Stale `pre-migration-*` pins are now
  age-reaped by scanning the tag pattern rather than trusting the state file —
  `migration_store::load` reports an unparseable record as absent, which
  stranded a 4-12 GB pin nothing could name again; `load` now moves a corrupt
  record aside so `has_record` is trustworthy. A pin whose migration is still
  awaiting confirmation is never reaped at any age. The probe container's
  removal was a plain statement after an await, so a dropped future (an app quit
  mid-migration) leaked a container pinning a multi-gigabyte image; it is a
  `Drop` guard now, with `reap_probe_containers` for the case where the process
  itself dies.

* **Prune scheduler logs.** `remove` deleted a task's JSON but never its log
  directory, and the task runner appended uncapped `claude -p` output.

* **Fix the delete copy.** It said "the container, config volume, and stored
  credentials"; it removes *both* volumes and the snapshot image.

No prune UI, and no unfiltered `prune_images`/`prune_volumes` anywhere — the
daemon is shared with the user's unrelated work.

## Claude Code settings: two invented keys, one inverted default, one sticky bug

Verified against code.claude.com/docs/en/settings-reference.md and env-vars.md.

* `effort` -> **`effortLevel`**, the key Claude Code actually reads; the old one
  was written and silently ignored. `xhigh` added to the dropdown.
* `focusMode` -> **`viewMode: "focus"`**. `focusMode` was invented. The real key
  does exactly what the existing UI hint already described.
* **Session recap was inverted.** Claude Code's recap is on by default, so
  `CLAUDE_CODE_ENABLE_AWAY_SUMMARY=1`-when-enabled was a no-op and the control
  could never turn the recap *off*. The field is renamed to
  `session_recap_disabled` rather than reused: reusing the name with the
  opposite meaning would have read every stored `enable_session_recap: false` —
  which is every project that never touched the control — as "the user turned
  this off".
* **The stickiness, which is the important one.** Keys were emitted only when
  non-default, and the entrypoint *merges* into a settings.json on a persisted
  volume, so switching a setting off omitted its key, the merge preserved the
  stale on-value, and the setting stayed on until a destructive Reset. The fix
  already existed in the same file — the sandbox block is emitted
  unconditionally for exactly this reason — and is now applied to all five keys.
  A key whose neutral state is *unset* (`tui`, `effortLevel`, `viewMode`,
  `awaySummaryEnabled`) is emitted as JSON `null` and the entrypoint deletes it,
  because a stand-in value is not neutral: `tui: "default"` pins the classic
  renderer where unset lets Claude Code choose, and `viewMode: "default"`
  overrides the user's own sticky `/focus` choice.
* The same stickiness existed, unnoticed, in the **env vars**: `docker commit`
  bakes container env into the snapshot image, so a `=1` written once rode it
  forever. All four are now emitted on every create, extracted into
  `claude_code_env_vars` and unit tested. Two use an empty value for "off"
  rather than `0`, because they outrank a setting the user can change from
  inside their own container and Triple-C's default must not overrule a
  `/config` choice it never asked about.
* TUI mode is now a genuine three-way choice (automatic / classic / fullscreen),
  which the always-emitted key makes both necessary and possible.

`merge_claude_code_settings` is untouched by choice: a project-level OFF still
cannot override a globally-ON setting.

Tests: 364 frontend (+5), 308 Rust (+23), covering the scrub path list and
script, log rotation, pin reaping, and that toggling a setting off actually
clears a previously-set ON value.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GBq2rGum6GX7xXgsas1fDc

2026-08-23 08:35:10 -07:00

shadow-testandClaude Opus 5

01a2f6aec8

Add Project Home, Auth Bridge, shared auth token, and Tier-1 polish

Project Home (DESIGN-REVIEW §B2): the project is promoted from a 280px
sidebar card to a first-class main-area view. ProjectCard.tsx (1,257
lines) is replaced by a select-only ProjectRow plus tabs for Overview,
Sessions, Automation, Config and Files. The PortMappings, FileManager
and ContainerProgress modals are absorbed rather than reimplemented.
Config gains a Saved/Saving/Failed indicator — save-on-blur failures
previously reached only console.error.

Tier-1 polish (DESIGN-REVIEW §A): new elevation, muted-accent, disabled
and focus-ring tokens; a global :focus-visible ring with every
focus:outline-none removed; filled buttons moved to --accent-emphasis
and white-on-success toggles retired, fixing three WCAG AA failures
(2.1:1, 2.5:1, 2.4:1); a shared Modal primitive with role="dialog",
focus trap and restore, adopted by all remaining modals; status
indicators that carry a glyph and word rather than colour alone.

Ctrl+Shift+W closes a tab, deliberately not Ctrl+W — that is readline's
kill-word, used constantly in the terminal this app is built around.

Auth Bridge: a general loopback-callback bridge so browser logins run
inside a container (aws sso login, Concourse fly login, claude login)
can complete against the host browser. Listeners are discovered from
/proc/net/tcp{,6} — ss/netstat/lsof are absent from the image — bound on
host 127.0.0.1 only, and tunnelled in over the Docker API via socat,
which keeps working on Docker Desktop where container IPs are not
routable. Falls back to [::1] because Node resolves localhost to IPv6
first, so claude login often binds ::1 alone. Opt-in per project.

This extracts create_attached_exec() and moves the existing terminal
session path onto it, so there is one attached-exec implementation
rather than two.

Shared auth token: `claude setup-token` is run in a container, the token
is stored in the OS keychain and injected as CLAUDE_CODE_OAUTH_TOKEN
into Anthropic-backend projects. Contrary to the initial design note,
setup-token uses an Anthropic-hosted redirect and blocks on a stdin
paste prompt rather than a loopback callback, so a stdin command is
required for the flow to complete.

The token is never logged, never returned to the frontend, and is
redacted from the streamed output with a stateful matcher that withholds
any tail that could still grow into a secret. Change detection uses a
random rotation id rather than a hash, since a hash in a docker-inspect
readable label would be an offline verification oracle.

Frontend 33 -> 51 tests; Rust 34 tests. Both builds clean.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-08-09 11:35:42 -07:00