fix: hivectl choom enters as the agent user from the state dir so claude gets creds + session

This commit is contained in:
damocles 2026-06-05 21:41:50 +02:00
commit c59a0de01e
3 changed files with 62 additions and 17 deletions

View file

@ -279,7 +279,9 @@ Stop and restart ALL managed agent containers in sequence. Iterates the live con
Open an interactive Claude session inside an agent container.
Replaces the current process with `machinectl shell h-<name>` running `claude --continue` — drops the operator straight into the agent's live Claude session with its full loaded context and persona. Requires root (same as all machinectl shell operations) and the container must be running.
Replaces the current process with `machinectl shell <name>@h-<name>` running `claude --continue` from the agent's state dir — drops the operator straight into the agent's live Claude session with its full loaded context and persona. Requires root (same as all machinectl shell operations) and the container must be running.
The session is entered **as the agent user** (not root): claude reads its OAuth credentials + settings from the agent's `/home/<name>/.claude`, and the working directory is set to the agent's state dir (`/agents/<name>/state`) so `--continue` resumes the same per-project session the harness runs. Entering as root (the `machinectl shell` default) is what loses both.
Pass `--fresh` to start a new Claude session instead of continuing the most recent one.

View file

@ -111,9 +111,9 @@ reported at the end rather than aborting mid-run.
## Choom
Drop into an interactive Claude session inside an agent container.
Replaces the current process with `machinectl shell h-<name>` running
`claude --continue`. Requires root (same as all `machinectl shell`
operations).
Replaces the current process with `machinectl shell <name>@h-<name>`
running `claude --continue` from the agent's state dir. Requires root
(same as all `machinectl shell` operations).
```bash
hivectl choom iris # join iris's ongoing Claude session (--continue)
@ -123,3 +123,11 @@ hivectl choom iris --fresh # start a new Claude session instead
Without `--fresh`, `--continue` is passed so the operator joins the
agent's live context window. With `--fresh` a clean session starts.
The container must be running.
The session is entered **as the agent user**, not root: `machinectl
shell` defaults to root in the container, which would make claude read
`/root/.claude` (empty) instead of the agent's `/home/<name>/.claude`
where its OAuth credentials + settings live. choom prefixes the
machine with `<name>@` (the meta-flake sets the agent's unix user name
to its label) and `cd`s into `/agents/<name>/state` first so
`--continue` resolves the same per-project session the harness runs.