From c7d95f3992d24f86ff71e5f3e18260a8ef8a09f0 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sun, 24 May 2026 08:47:07 +0000
Subject: feat(executor): introduce AgentChannel seam for runner signals
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Defines AgentChannel — the normalized interface by which a runner reports
agent-originated signals (AskUser, ReportSummary, SpawnSubtask,
RecordProgress) — plus a default storeChannel implementation backed by
storage. Runner.Run now takes an AgentChannel; the pool constructs one
per execution.

The file transport routes its post-exit summary detection through
ch.ReportSummary (buffered onto the execution so the pool still applies
its extract/synthesize fallbacks, no double-write). AskUser returns
ErrAgentBlocked since write-and-exit cannot answer in-session; question
persistence stays with the pool's BlockedError handling. SpawnSubtask
and RecordProgress are implemented and tested, ready for the MCP
transport in Phase 2 where the channel becomes fully load-bearing.

Store gains CreateEvent so the channel can emit agent_message events.

https://claude.ai/code/session_01SESwn7kQ7oP62trWw6pc39
---
 internal/executor/container.go | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

(limited to 'internal/executor/container.go')

diff --git a/internal/executor/container.go b/internal/executor/container.go
index 61ac29c..4269ef1 100644
--- a/internal/executor/container.go
+++ b/internal/executor/container.go
@@ -100,7 +100,7 @@ func (r *ContainerRunner) ensureStoryBranch(ctx context.Context, remoteURL, bran
 	return nil
 }
 
-func (r *ContainerRunner) Run(ctx context.Context, t *task.Task, e *storage.Execution) error {
+func (r *ContainerRunner) Run(ctx context.Context, t *task.Task, e *storage.Execution, ch AgentChannel) error {
 	var err error
 	repoURL := t.RepositoryURL
 	if repoURL == "" {
@@ -227,7 +227,7 @@ func (r *ContainerRunner) Run(ctx context.Context, t *task.Task, e *storage.Exec
 	}
 
 	// Run container (with auth retry on failure).
-	runErr := r.runContainer(ctx, t, e, workspace, agentHome, isResume, storyBranch)
+	runErr := r.runContainer(ctx, t, e, workspace, agentHome, isResume, storyBranch, ch)
 	if runErr != nil && isAuthError(runErr) && r.CredentialSyncCmd != "" {
 		r.Logger.Warn("auth failure detected, syncing credentials and retrying once", "taskID", t.ID)
 		syncOut, syncErr := r.command(ctx, r.CredentialSyncCmd).CombinedOutput()
@@ -241,7 +241,7 @@ func (r *ContainerRunner) Run(ctx context.Context, t *task.Task, e *storage.Exec
 		if srcData, readErr := os.ReadFile(filepath.Join(r.ClaudeConfigDir, ".claude.json")); readErr == nil {
 			_ = os.WriteFile(filepath.Join(agentHome, ".claude.json"), srcData, 0644)
 		}
-		runErr = r.runContainer(ctx, t, e, workspace, agentHome, isResume, storyBranch)
+		runErr = r.runContainer(ctx, t, e, workspace, agentHome, isResume, storyBranch, ch)
 	}
 
 	if runErr == nil {
@@ -257,7 +257,7 @@ func (r *ContainerRunner) Run(ctx context.Context, t *task.Task, e *storage.Exec
 
 // runContainer runs the docker container for the given task and handles log setup,
 // environment files, instructions, and post-execution git operations.
-func (r *ContainerRunner) runContainer(ctx context.Context, t *task.Task, e *storage.Execution, workspace, agentHome string, isResume bool, storyBranch string) error {
+func (r *ContainerRunner) runContainer(ctx context.Context, t *task.Task, e *storage.Execution, workspace, agentHome string, isResume bool, storyBranch string, ch AgentChannel) error {
 	repoURL := t.RepositoryURL
 
 	image := t.Agent.ContainerImage
@@ -372,7 +372,7 @@ func (r *ContainerRunner) runContainer(ctx context.Context, t *task.Task, e *sto
 		questionJSON := strings.TrimSpace(string(data))
 		if isCompletionReport(questionJSON) {
 			r.Logger.Info("treating question file as completion report", "taskID", e.TaskID)
-			e.Summary = extractQuestionText(questionJSON)
+			_ = ch.ReportSummary(ctx, extractQuestionText(questionJSON))
 		} else {
 			if e.SessionID == "" {
 				r.Logger.Warn("missing session ID; resume will start fresh", "taskID", e.TaskID)
@@ -389,7 +389,7 @@ func (r *ContainerRunner) runContainer(ctx context.Context, t *task.Task, e *sto
 	summaryFile := filepath.Join(logDir, "summary.txt")
 	if summaryData, readErr := os.ReadFile(summaryFile); readErr == nil {
 		os.Remove(summaryFile) // consumed
-		e.Summary = strings.TrimSpace(string(summaryData))
+		_ = ch.ReportSummary(ctx, strings.TrimSpace(string(summaryData)))
 	}
 
 	// 5. Post-execution: push changes if successful
-- 
cgit v1.2.3


From 952b7623ee9dceec15099043086622aa2aab4741 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sun, 24 May 2026 09:45:16 +0000
Subject: feat(executor,api): wire agent MCP into ContainerRunner + mount /mcp
 (Phase 2)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

ContainerRunner now mints a per-task MCP token (from an injected Registry),
writes a claude mcp-config into the workspace pointing at the host agent MCP
server over host.docker.internal with that bearer, and adds --mcp-config to the
in-container claude invocation. The token is revoked when the run ends. After
the run, a buffered ask_user (PendingQuestion on the channel) is converted into
a BlockedError — the MCP path to BLOCKED — with the file-based question.json
kept as a fallback for in-flight tasks started on the old wire.

The API server mounts the StreamableHTTP MCP handler at POST/GET/DELETE /mcp
when a registry is provided; serve.go constructs one Registry shared by the
runners (mint) and the server (resolve). Minting is skipped for gemini agents.

Tests: writeMCPConfig output shape, buildInnerCmd flag presence/absence, and an
api-level end-to-end MCP tool call through NewServer/Handler proving the route
is mounted (and absent without a registry).

https://claude.ai/code/session_01SESwn7kQ7oP62trWw6pc39
---
 internal/api/agentmcp_endpoint_test.go | 104 +++++++++++++++++++++++++++++++++
 internal/api/server.go                 |  13 ++++-
 internal/api/server_test.go            |   4 +-
 internal/cli/serve.go                  |   8 ++-
 internal/executor/channel.go           |  15 +++++
 internal/executor/container.go         |  63 +++++++++++++++++++-
 internal/executor/container_test.go    |  58 ++++++++++++++++--
 7 files changed, 253 insertions(+), 12 deletions(-)
 create mode 100644 internal/api/agentmcp_endpoint_test.go

(limited to 'internal/executor/container.go')

diff --git a/internal/api/agentmcp_endpoint_test.go b/internal/api/agentmcp_endpoint_test.go
new file mode 100644
index 0000000..b2f77d3
--- /dev/null
+++ b/internal/api/agentmcp_endpoint_test.go
@@ -0,0 +1,104 @@
+package api
+
+import (
+	"context"
+	"log/slog"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/modelcontextprotocol/go-sdk/mcp"
+	"github.com/thepeterstone/claudomator/internal/executor"
+	"github.com/thepeterstone/claudomator/internal/storage"
+)
+
+type fakeAgentChannel struct{ progress []string }
+
+func (f *fakeAgentChannel) AskUser(context.Context, string) (string, error) {
+	return "", executor.ErrAgentBlocked
+}
+func (f *fakeAgentChannel) ReportSummary(context.Context, string) error { return nil }
+func (f *fakeAgentChannel) SpawnSubtask(context.Context, executor.SubtaskSpec) (string, error) {
+	return "sub", nil
+}
+func (f *fakeAgentChannel) RecordProgress(_ context.Context, m string) error {
+	f.progress = append(f.progress, m)
+	return nil
+}
+
+type tokenRT struct {
+	token string
+	base  http.RoundTripper
+}
+
+func (b tokenRT) RoundTrip(r *http.Request) (*http.Response, error) {
+	r = r.Clone(r.Context())
+	r.Header.Set("Authorization", "Bearer "+b.token)
+	return b.base.RoundTrip(r)
+}
+
+func TestServer_MountsAgentMCPEndpoint(t *testing.T) {
+	store, err := storage.Open(filepath.Join(t.TempDir(), "test.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer store.Close()
+	logger := slog.New(slog.NewTextHandler(os.Stderr, &slog.HandlerOptions{Level: slog.LevelError}))
+	pool := executor.NewPool(1, map[string]executor.Runner{}, store, logger)
+
+	reg := executor.NewRegistry()
+	fc := &fakeAgentChannel{}
+	token, _ := reg.Mint(fc)
+
+	srv := NewServer(store, pool, reg, logger, "claude", "gemini")
+	ts := httptest.NewServer(srv.Handler())
+	defer ts.Close()
+
+	client := mcp.NewClient(&mcp.Implementation{Name: "test", Version: "1"}, nil)
+	cs, err := client.Connect(context.Background(), &mcp.StreamableClientTransport{
+		Endpoint:   ts.URL + "/mcp",
+		HTTPClient: &http.Client{Transport: tokenRT{token: token, base: http.DefaultTransport}},
+	}, nil)
+	if err != nil {
+		t.Fatalf("connect to mounted /mcp: %v", err)
+	}
+	defer cs.Close()
+
+	if _, err := cs.CallTool(context.Background(), &mcp.CallToolParams{
+		Name:      "record_progress",
+		Arguments: map[string]any{"message": "via api server"},
+	}); err != nil {
+		t.Fatalf("CallTool through api server: %v", err)
+	}
+	if len(fc.progress) != 1 || fc.progress[0] != "via api server" {
+		t.Errorf("tool call did not reach channel: %+v", fc.progress)
+	}
+}
+
+func TestServer_NoRegistry_NoMCPRoute(t *testing.T) {
+	store, err := storage.Open(filepath.Join(t.TempDir(), "test.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer store.Close()
+	logger := slog.New(slog.NewTextHandler(os.Stderr, &slog.HandlerOptions{Level: slog.LevelError}))
+	pool := executor.NewPool(1, map[string]executor.Runner{}, store, logger)
+
+	// nil registry → /mcp must not be mounted.
+	srv := NewServer(store, pool, nil, logger, "claude", "gemini")
+	ts := httptest.NewServer(srv.Handler())
+	defer ts.Close()
+
+	resp, err := http.Post(ts.URL+"/mcp", "application/json", http.NoBody)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer resp.Body.Close()
+	// Unmounted: the catch-all "GET /" route rejects POST with 405. A mounted
+	// MCP handler would instead respond (e.g. 400 for the missing token).
+	if resp.StatusCode == http.StatusBadRequest {
+		t.Errorf("expected /mcp to be absent without a registry, got 400 (handler ran)")
+	}
+}
diff --git a/internal/api/server.go b/internal/api/server.go
index ff3a111..1522b72 100644
--- a/internal/api/server.go
+++ b/internal/api/server.go
@@ -39,6 +39,7 @@ type Server struct {
 	taskLogStore     taskLogStore   // injectable for tests; defaults to store
 	questionStore    questionStore  // injectable for tests; defaults to store
 	pool             *executor.Pool
+	registry         *executor.Registry // per-task agent MCP token registry; mounts /mcp when set
 	hub              *Hub
 	logger           *slog.Logger
 	mux              *http.ServeMux
@@ -100,7 +101,7 @@ func (s *Server) SetLLM(c *llm.Client) {
 }
 
 
-func NewServer(store *storage.DB, pool *executor.Pool, logger *slog.Logger, claudeBinPath, geminiBinPath string) *Server {
+func NewServer(store *storage.DB, pool *executor.Pool, registry *executor.Registry, logger *slog.Logger, claudeBinPath, geminiBinPath string) *Server {
 	wd, _ := os.Getwd()
 	s := &Server{
 		ctx:           context.Background(),
@@ -109,6 +110,7 @@ func NewServer(store *storage.DB, pool *executor.Pool, logger *slog.Logger, clau
 		taskLogStore:  store,
 		questionStore: store,
 		pool:          pool,
+		registry:      registry,
 		hub:           NewHub(),
 		logger:        logger,
 		mux:           http.NewServeMux(),
@@ -180,6 +182,15 @@ func (s *Server) routes() {
 	s.mux.HandleFunc("GET /api/drops", s.handleListDrops)
 	s.mux.HandleFunc("GET /api/drops/{filename}", s.handleGetDrop)
 	s.mux.HandleFunc("POST /api/drops", s.handlePostDrop)
+	if s.registry != nil {
+		mcpHandler := executor.NewAgentMCPHandler(s.registry)
+		// The streamable HTTP transport uses POST (messages), GET (SSE stream),
+		// and DELETE (session end). Register them explicitly so the patterns are
+		// more specific than the "GET /" catch-all and don't conflict.
+		s.mux.Handle("POST /mcp", mcpHandler)
+		s.mux.Handle("GET /mcp", mcpHandler)
+		s.mux.Handle("DELETE /mcp", mcpHandler)
+	}
 	s.mux.Handle("GET /", http.FileServerFS(webui.Files))
 }
 
diff --git a/internal/api/server_test.go b/internal/api/server_test.go
index f902495..dd6eed5 100644
--- a/internal/api/server_test.go
+++ b/internal/api/server_test.go
@@ -98,7 +98,7 @@ func testServerWithRunner(t *testing.T, runner executor.Runner) (*Server, *stora
 		"gemini": runner,
 	}
 	pool := executor.NewPool(2, runners, store, logger)
-	srv := NewServer(store, pool, logger, "claude", "gemini")
+	srv := NewServer(store, pool, nil, logger, "claude", "gemini")
 	return srv, store
 }
 
@@ -194,7 +194,7 @@ func testServerWithGeminiMockRunner(t *testing.T) (*Server, *storage.DB) {
 		"gemini": mr,
 	}
 	pool := executor.NewPool(2, runners, store, logger)
-	srv := NewServer(store, pool, logger, "claude", "gemini")
+	srv := NewServer(store, pool, nil, logger, "claude", "gemini")
 	return srv, store
 }
 
diff --git a/internal/cli/serve.go b/internal/cli/serve.go
index 459c35b..b23304b 100644
--- a/internal/cli/serve.go
+++ b/internal/cli/serve.go
@@ -79,6 +79,9 @@ func serve(addr string) error {
 	claudeConfigDir := cfg.ClaudeConfigDir
 
 	repoDir, _ := os.Getwd()
+	// Shared per-task agent MCP token registry: runners mint tokens; the API
+	// server mounts /mcp and resolves them.
+	agentRegistry := executor.NewRegistry()
 	runners := map[string]executor.Runner{
 		// ContainerRunner: binaries are resolved via PATH inside the container image,
 		// so ClaudeBinary/GeminiBinary are left empty (host paths would not exist inside).
@@ -92,6 +95,7 @@ func serve(addr string) error {
 			ClaudeConfigDir:   claudeConfigDir,
 			CredentialSyncCmd: filepath.Join(repoDir, "scripts", "sync-credentials"),
 			Store:             store,
+			Registry:          agentRegistry,
 		},
 		"gemini": &executor.ContainerRunner{
 			Image:             cfg.GeminiImage,
@@ -103,6 +107,7 @@ func serve(addr string) error {
 			ClaudeConfigDir:   claudeConfigDir,
 			CredentialSyncCmd: filepath.Join(repoDir, "scripts", "sync-credentials"),
 			Store:             store,
+			Registry:          agentRegistry,
 		},
 		"container": &executor.ContainerRunner{
 			Image:             "claudomator-agent:latest",
@@ -114,6 +119,7 @@ func serve(addr string) error {
 			ClaudeConfigDir:   claudeConfigDir,
 			CredentialSyncCmd: filepath.Join(repoDir, "scripts", "sync-credentials"),
 			Store:             store,
+			Registry:          agentRegistry,
 		},
 	}
 
@@ -146,7 +152,7 @@ func serve(addr string) error {
 	pool.RecoverStaleQueued(context.Background())
 	pool.RecoverStaleBlocked()
 
-	srv := api.NewServer(store, pool, logger, cfg.ClaudeBinaryPath, cfg.GeminiBinaryPath)
+	srv := api.NewServer(store, pool, agentRegistry, logger, cfg.ClaudeBinaryPath, cfg.GeminiBinaryPath)
 
 	// Configure notifiers: combine webhook (if set) with web push.
 	notifiers := []notify.Notifier{}
diff --git a/internal/executor/channel.go b/internal/executor/channel.go
index 541694b..8605ffa 100644
--- a/internal/executor/channel.go
+++ b/internal/executor/channel.go
@@ -50,6 +50,21 @@ type channelStore interface {
 	CreateEvent(e *event.Event) error
 }
 
+// pendingAsker is implemented by channels that buffer an ask_user call so the
+// runner can convert it into a BlockedError after the agent subprocess exits.
+type pendingAsker interface {
+	PendingQuestion() (questionJSON string, blocked bool)
+}
+
+// channelPendingQuestion reports whether the agent asked a question via the
+// channel during the run (the MCP transport's ask_user path).
+func channelPendingQuestion(ch AgentChannel) (string, bool) {
+	if pa, ok := ch.(pendingAsker); ok {
+		return pa.PendingQuestion()
+	}
+	return "", false
+}
+
 // storeChannel is the default AgentChannel backed by storage. Summary and
 // question signals are buffered here under a mutex (they may arrive on an MCP
 // handler goroutine mid-run); the pool flushes the summary to the execution and
diff --git a/internal/executor/container.go b/internal/executor/container.go
index 4269ef1..f0f728c 100644
--- a/internal/executor/container.go
+++ b/internal/executor/container.go
@@ -2,6 +2,7 @@ package executor
 
 import (
 	"context"
+	"encoding/json"
 	"errors"
 	"fmt"
 	"log/slog"
@@ -29,6 +30,9 @@ type ContainerRunner struct {
 	ClaudeConfigDir    string // host path to ~/.claude; mounted into container for auth credentials
 	CredentialSyncCmd  string // optional path to sync-credentials script for auth-error auto-recovery
 	Store              Store  // optional; used to look up stories and projects for story-aware cloning
+	// Registry mints the per-task MCP token; when set, the agent gets an
+	// mcp-config pointing at the host agent MCP server.
+	Registry *Registry
 	// Command allows mocking exec.CommandContext for tests.
 	Command func(ctx context.Context, name string, arg ...string) *exec.Cmd
 }
@@ -307,8 +311,24 @@ func (r *ContainerRunner) runContainer(ctx context.Context, t *task.Task, e *sto
 		return fmt.Errorf("writing instructions: %w", err)
 	}
 
+	// Per-task MCP back-channel: mint a scoped token bound to this run's channel
+	// and write an mcp-config pointing the agent at the host agent MCP server.
+	mcpEnabled := false
+	if r.Registry != nil && t.Agent.Type != "gemini" {
+		token, mintErr := r.Registry.Mint(ch)
+		if mintErr != nil {
+			return fmt.Errorf("minting agent mcp token: %w", mintErr)
+		}
+		defer r.Registry.Revoke(token)
+		mcpURL := strings.TrimRight(strings.ReplaceAll(r.APIURL, "localhost", "host.docker.internal"), "/") + "/mcp"
+		if err := writeMCPConfig(workspace, mcpURL, token); err != nil {
+			return fmt.Errorf("writing mcp config: %w", err)
+		}
+		mcpEnabled = true
+	}
+
 	args := r.buildDockerArgs(workspace, agentHome, e.TaskID)
-	innerCmd := r.buildInnerCmd(t, e, isResume)
+	innerCmd := r.buildInnerCmd(t, e, isResume, mcpEnabled)
 
 	fullArgs := append(args, image)
 	fullArgs = append(fullArgs, innerCmd...)
@@ -365,7 +385,17 @@ func (r *ContainerRunner) runContainer(ctx context.Context, t *task.Task, e *sto
 		e.SessionID = sessionID
 	}
 
-	// Check whether the agent left a question before exiting.
+	// MCP transport: if the agent called ask_user, the question is buffered on
+	// the channel. Block so the task resumes with the user's answer.
+	if q, blocked := channelPendingQuestion(ch); blocked {
+		if e.SessionID == "" {
+			r.Logger.Warn("missing session ID; resume will start fresh", "taskID", e.TaskID)
+		}
+		return &BlockedError{QuestionJSON: q, SessionID: e.SessionID, SandboxDir: workspace}
+	}
+
+	// Check whether the agent left a question before exiting (file fallback for
+	// in-flight tasks started on the pre-MCP wire).
 	questionFile := filepath.Join(logDir, "question.json")
 	if data, readErr := os.ReadFile(questionFile); readErr == nil {
 		os.Remove(questionFile) // consumed
@@ -467,7 +497,30 @@ func (r *ContainerRunner) buildDockerArgs(workspace, claudeHome, taskID string)
 	return args
 }
 
-func (r *ContainerRunner) buildInnerCmd(t *task.Task, e *storage.Execution, isResume bool) []string {
+// mcpConfigContainerPath is where the agent mcp-config is mounted in-container
+// (the workspace is bind-mounted at /workspace).
+const mcpConfigContainerPath = "/workspace/.claudomator-mcp.json"
+
+// writeMCPConfig writes a claude CLI mcp-config that registers the per-task
+// agent MCP server over HTTP with a bearer token.
+func writeMCPConfig(workspace, mcpURL, token string) error {
+	cfg := map[string]any{
+		"mcpServers": map[string]any{
+			"claudomator": map[string]any{
+				"type":    "http",
+				"url":     mcpURL,
+				"headers": map[string]string{"Authorization": "Bearer " + token},
+			},
+		},
+	}
+	data, err := json.Marshal(cfg)
+	if err != nil {
+		return err
+	}
+	return os.WriteFile(filepath.Join(workspace, ".claudomator-mcp.json"), data, 0600)
+}
+
+func (r *ContainerRunner) buildInnerCmd(t *task.Task, e *storage.Execution, isResume, mcpEnabled bool) []string {
 	// Claude CLI uses -p for prompt text. To pass a file, we use a shell to cat it.
 	// We use a shell variable to capture the expansion to avoid quoting issues with instructions contents.
 	// The outer single quotes around the sh -c argument prevent host-side expansion.
@@ -491,6 +544,9 @@ func (r *ContainerRunner) buildInnerCmd(t *task.Task, e *storage.Execution, isRe
 	if isResume && e.ResumeSessionID != "" {
 		claudeCmd.WriteString(fmt.Sprintf(" --resume %s", e.ResumeSessionID))
 	}
+	if mcpEnabled {
+		claudeCmd.WriteString(" --mcp-config " + mcpConfigContainerPath)
+	}
 	claudeCmd.WriteString(" --output-format stream-json --verbose --permission-mode bypassPermissions")
 
 	return []string{"sh", "-c", claudeCmd.String()}
@@ -501,6 +557,7 @@ func (r *ContainerRunner) buildInnerCmd(t *task.Task, e *storage.Execution, isRe
 var scaffoldPrefixes = []string{
 	".claudomator-env",
 	".claudomator-instructions.txt",
+	".claudomator-mcp.json",
 	".agent-home",
 }
 
diff --git a/internal/executor/container_test.go b/internal/executor/container_test.go
index 9cd80dc..86e95e2 100644
--- a/internal/executor/container_test.go
+++ b/internal/executor/container_test.go
@@ -2,6 +2,7 @@ package executor
 
 import (
 	"context"
+	"encoding/json"
 	"fmt"
 	"io"
 	"log/slog"
@@ -53,13 +54,44 @@ func TestContainerRunner_BuildDockerArgs(t *testing.T) {
 	}
 }
 
+func TestWriteMCPConfig(t *testing.T) {
+	dir := t.TempDir()
+	if err := writeMCPConfig(dir, "http://host.docker.internal:8484/mcp", "tok-abc"); err != nil {
+		t.Fatalf("writeMCPConfig: %v", err)
+	}
+	data, err := os.ReadFile(filepath.Join(dir, ".claudomator-mcp.json"))
+	if err != nil {
+		t.Fatalf("read config: %v", err)
+	}
+	var parsed struct {
+		MCPServers map[string]struct {
+			Type    string            `json:"type"`
+			URL     string            `json:"url"`
+			Headers map[string]string `json:"headers"`
+		} `json:"mcpServers"`
+	}
+	if err := json.Unmarshal(data, &parsed); err != nil {
+		t.Fatalf("config is not valid JSON: %v", err)
+	}
+	srv, ok := parsed.MCPServers["claudomator"]
+	if !ok {
+		t.Fatal("expected claudomator server entry")
+	}
+	if srv.Type != "http" || srv.URL != "http://host.docker.internal:8484/mcp" {
+		t.Errorf("unexpected server config: %+v", srv)
+	}
+	if srv.Headers["Authorization"] != "Bearer tok-abc" {
+		t.Errorf("expected bearer header, got %q", srv.Headers["Authorization"])
+	}
+}
+
 func TestContainerRunner_BuildInnerCmd(t *testing.T) {
 	runner := &ContainerRunner{}
 	
 	t.Run("claude-fresh", func(t *testing.T) {
 		tk := &task.Task{Agent: task.AgentConfig{Type: "claude"}}
 		exec := &storage.Execution{}
-		cmd := runner.buildInnerCmd(tk, exec, false)
+		cmd := runner.buildInnerCmd(tk, exec, false, false)
 		
 		cmdStr := strings.Join(cmd, " ")
 		if strings.Contains(cmdStr, "--resume") {
@@ -73,7 +105,7 @@ func TestContainerRunner_BuildInnerCmd(t *testing.T) {
 	t.Run("claude-resume", func(t *testing.T) {
 		tk := &task.Task{Agent: task.AgentConfig{Type: "claude"}}
 		exec := &storage.Execution{ResumeSessionID: "orig-session-123"}
-		cmd := runner.buildInnerCmd(tk, exec, true)
+		cmd := runner.buildInnerCmd(tk, exec, true, false)
 		
 		cmdStr := strings.Join(cmd, " ")
 		if !strings.Contains(cmdStr, "--resume orig-session-123") {
@@ -81,10 +113,26 @@ func TestContainerRunner_BuildInnerCmd(t *testing.T) {
 		}
 	})
 
+	t.Run("claude-mcp-enabled", func(t *testing.T) {
+		tk := &task.Task{Agent: task.AgentConfig{Type: "claude"}}
+		cmdStr := strings.Join(runner.buildInnerCmd(tk, &storage.Execution{}, false, true), " ")
+		if !strings.Contains(cmdStr, "--mcp-config "+mcpConfigContainerPath) {
+			t.Errorf("expected --mcp-config flag when MCP enabled, got %q", cmdStr)
+		}
+	})
+
+	t.Run("claude-mcp-disabled", func(t *testing.T) {
+		tk := &task.Task{Agent: task.AgentConfig{Type: "claude"}}
+		cmdStr := strings.Join(runner.buildInnerCmd(tk, &storage.Execution{}, false, false), " ")
+		if strings.Contains(cmdStr, "--mcp-config") {
+			t.Errorf("did not expect --mcp-config flag when MCP disabled, got %q", cmdStr)
+		}
+	})
+
 	t.Run("gemini", func(t *testing.T) {
 		tk := &task.Task{Agent: task.AgentConfig{Type: "gemini"}}
 		exec := &storage.Execution{}
-		cmd := runner.buildInnerCmd(tk, exec, false)
+		cmd := runner.buildInnerCmd(tk, exec, false, false)
 
 		cmdStr := strings.Join(cmd, " ")
 		if !strings.Contains(cmdStr, "gemini -p \"$INST\"") {
@@ -99,13 +147,13 @@ func TestContainerRunner_BuildInnerCmd(t *testing.T) {
 		}
 		
 		tkClaude := &task.Task{Agent: task.AgentConfig{Type: "claude"}}
-		cmdClaude := runnerCustom.buildInnerCmd(tkClaude, &storage.Execution{}, false)
+		cmdClaude := runnerCustom.buildInnerCmd(tkClaude, &storage.Execution{}, false, false)
 		if !strings.Contains(strings.Join(cmdClaude, " "), "/usr/bin/claude-v2 -p") {
 			t.Errorf("expected custom claude binary, got %q", cmdClaude)
 		}
 
 		tkGemini := &task.Task{Agent: task.AgentConfig{Type: "gemini"}}
-		cmdGemini := runnerCustom.buildInnerCmd(tkGemini, &storage.Execution{}, false)
+		cmdGemini := runnerCustom.buildInnerCmd(tkGemini, &storage.Execution{}, false, false)
 		if !strings.Contains(strings.Join(cmdGemini, " "), "/usr/local/bin/gemini-pro -p") {
 			t.Errorf("expected custom gemini binary, got %q", cmdGemini)
 		}
-- 
cgit v1.2.3


From 473d80224880dd718cb2612fd49b987cd6097b2c Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sun, 24 May 2026 17:38:53 +0000
Subject: feat(executor): MCP-oriented planning preamble, applied by
 ContainerRunner (Phase 2)

Rewrites the planning preamble to point the agent at the four MCP tools
(ask_user/report_summary/spawn_subtask/record_progress) instead of the
CLAUDOMATOR_QUESTION_FILE / CLAUDOMATOR_SUMMARY_FILE conventions: ask_user ends
the turn, report_summary replaces the summary file, spawn_subtask replaces the
POST-to-/api/tasks planning step. Git discipline is retained.

ContainerRunner previously applied no preamble at all; it now prepends this
preamble (via buildAgentInstructions) when the MCP back-channel is active and
skip_planning is false, so the in-container agent is actually guided to use the
tools. Gemini agents (no MCP) are unaffected.

https://claude.ai/code/session_01SESwn7kQ7oP62trWw6pc39
---
 internal/executor/container.go      | 26 ++++++++++----
 internal/executor/container_test.go | 22 ++++++++++++
 internal/executor/preamble.go       | 67 +++++++++++++++----------------------
 internal/executor/preamble_test.go  | 30 +++++++++++------
 4 files changed, 89 insertions(+), 56 deletions(-)

(limited to 'internal/executor/container.go')

diff --git a/internal/executor/container.go b/internal/executor/container.go
index f0f728c..78c3ed7 100644
--- a/internal/executor/container.go
+++ b/internal/executor/container.go
@@ -305,12 +305,6 @@ func (r *ContainerRunner) runContainer(ctx context.Context, t *task.Task, e *sto
 		return fmt.Errorf("writing env file: %w", err)
 	}
 
-	// Inject custom instructions via file to avoid CLI length limits
-	instructionsFile := filepath.Join(workspace, ".claudomator-instructions.txt")
-	if err := os.WriteFile(instructionsFile, []byte(t.Agent.Instructions), 0644); err != nil {
-		return fmt.Errorf("writing instructions: %w", err)
-	}
-
 	// Per-task MCP back-channel: mint a scoped token bound to this run's channel
 	// and write an mcp-config pointing the agent at the host agent MCP server.
 	mcpEnabled := false
@@ -327,6 +321,15 @@ func (r *ContainerRunner) runContainer(ctx context.Context, t *task.Task, e *sto
 		mcpEnabled = true
 	}
 
+	// Inject custom instructions via file to avoid CLI length limits. When the
+	// MCP back-channel is active, prepend the planning preamble that points the
+	// agent at the ask_user/report_summary/spawn_subtask/record_progress tools.
+	instructions := buildAgentInstructions(t, mcpEnabled)
+	instructionsFile := filepath.Join(workspace, ".claudomator-instructions.txt")
+	if err := os.WriteFile(instructionsFile, []byte(instructions), 0644); err != nil {
+		return fmt.Errorf("writing instructions: %w", err)
+	}
+
 	args := r.buildDockerArgs(workspace, agentHome, e.TaskID)
 	innerCmd := r.buildInnerCmd(t, e, isResume, mcpEnabled)
 
@@ -501,6 +504,17 @@ func (r *ContainerRunner) buildDockerArgs(workspace, claudeHome, taskID string)
 // (the workspace is bind-mounted at /workspace).
 const mcpConfigContainerPath = "/workspace/.claudomator-mcp.json"
 
+// buildAgentInstructions returns the agent's instructions, prepending the
+// MCP-tool planning preamble when the back-channel is active and planning is
+// not skipped.
+func buildAgentInstructions(t *task.Task, mcpEnabled bool) string {
+	instructions := t.Agent.Instructions
+	if mcpEnabled && !t.Agent.SkipPlanning {
+		instructions = withPlanningPreamble(instructions)
+	}
+	return instructions
+}
+
 // writeMCPConfig writes a claude CLI mcp-config that registers the per-task
 // agent MCP server over HTTP with a bearer token.
 func writeMCPConfig(workspace, mcpURL, token string) error {
diff --git a/internal/executor/container_test.go b/internal/executor/container_test.go
index 86e95e2..3d0887c 100644
--- a/internal/executor/container_test.go
+++ b/internal/executor/container_test.go
@@ -54,6 +54,28 @@ func TestContainerRunner_BuildDockerArgs(t *testing.T) {
 	}
 }
 
+func TestBuildAgentInstructions(t *testing.T) {
+	t.Run("mcp enabled prepends preamble", func(t *testing.T) {
+		tk := &task.Task{Agent: task.AgentConfig{Instructions: "do the thing"}}
+		got := buildAgentInstructions(tk, true)
+		if !strings.HasPrefix(got, planningPreamble) || !strings.HasSuffix(got, "do the thing") {
+			t.Errorf("expected preamble + instructions, got %q", got)
+		}
+	})
+	t.Run("mcp disabled keeps raw instructions", func(t *testing.T) {
+		tk := &task.Task{Agent: task.AgentConfig{Instructions: "do the thing"}}
+		if got := buildAgentInstructions(tk, false); got != "do the thing" {
+			t.Errorf("expected raw instructions, got %q", got)
+		}
+	})
+	t.Run("skip planning keeps raw instructions even with mcp", func(t *testing.T) {
+		tk := &task.Task{Agent: task.AgentConfig{Instructions: "do the thing", SkipPlanning: true}}
+		if got := buildAgentInstructions(tk, true); got != "do the thing" {
+			t.Errorf("expected raw instructions when skip_planning, got %q", got)
+		}
+	})
+}
+
 func TestWriteMCPConfig(t *testing.T) {
 	dir := t.TempDir()
 	if err := writeMCPConfig(dir, "http://host.docker.internal:8484/mcp", "tok-abc"); err != nil {
diff --git a/internal/executor/preamble.go b/internal/executor/preamble.go
index b949986..77fae3c 100644
--- a/internal/executor/preamble.go
+++ b/internal/executor/preamble.go
@@ -2,61 +2,48 @@ package executor
 
 const planningPreamble = `## Runtime Environment
 
-You are running as a background agent inside Claudomator. You cannot interact
-with the user directly. However, if you need a decision or clarification:
-
-**To ask the user a question and pause:**
-1. Write a JSON object to the path in $CLAUDOMATOR_QUESTION_FILE:
-   {"text": "Your question here?", "options": ["option A", "option B"]}
-   (options is optional — omit it for free-text answers)
-2. Exit immediately. Do not wait. The task will be resumed with the user's answer
-   as the next message in this conversation.
-
-Only use this when you genuinely need user input to proceed. The text MUST be a
-real question ending with "?". Do NOT write completion reports or status updates
-here — use $CLAUDOMATOR_SUMMARY_FILE for those. Prefer making a reasonable
-decision and noting it in your summary rather than asking.
+You are running as a background agent inside Claudomator. You cannot chat with
+the user directly, but you have these tools to coordinate:
+
+- **ask_user** — ask the user a question when you genuinely need a decision to
+  proceed. After calling it, end your turn immediately; the task pauses and is
+  resumed with the user's answer. Prefer making a reasonable decision and noting
+  it via report_summary over asking.
+- **report_summary** — record a 2-5 sentence summary of what you did. Call this
+  before you finish so the user knows the outcome.
+- **spawn_subtask** — create a child task to be run separately.
+- **record_progress** — leave a short progress note in the task timeline.
 
 ---
 
 ## Planning Step (do this first)
 
-Before doing any implementation work:
-
-1. Estimate: will this task take more than 3 minutes of implementation effort?
+Before doing any implementation work, estimate whether the task will take more
+than ~3 minutes of effort.
 
-2. If YES — break it down:
-   - Create 3–7 discrete subtasks by POSTing to $CLAUDOMATOR_API_URL/api/tasks
-   - Each subtask POST body should be JSON with: name, agent.instructions, agent.project_dir (copy from $CLAUDOMATOR_PROJECT_DIR), agent.model, agent.allowed_tools, and agent.skip_planning set to true
-   - Set parent_task_id to $CLAUDOMATOR_TASK_ID in each POST body
-   - After creating all subtasks, output a brief summary and STOP. Do not implement anything.
-   - You can also specify agent.type (either "claude" or "gemini") to choose the agent for subtasks.
-
-3. If NO — proceed with the task instructions below.
+- If YES — break it into 3-7 focused pieces with spawn_subtask, then call
+  report_summary describing the breakdown and STOP. Do not implement anything.
+- If NO — proceed with the task instructions below.
 
 ---
 
-## Git Discipline (mandatory when project_dir is set)
+## Git Discipline (mandatory when working in a repository)
 
-Every change you make to the working directory **must be committed before you finish**.
-The sandbox is rejected if there are any uncommitted modifications.
+Every change you make **must be committed before you finish** — the workspace is
+rejected if there are uncommitted modifications.
 
-- After completing work: run "git add -A && git commit -m 'concise description'"
-- One commit is fine. Multiple focused commits are also fine.
-- If you realise the task was already done and you made no changes, that is also fine — just exit cleanly without committing.
-- Do not exit with uncommitted edits.
-- **CRITICAL:** Run ALL git commands from your current directory — do NOT use absolute paths or "cd <project_path> && git ...". Your working directory IS the project. Using absolute paths bypasses the sandbox and breaks commit tracking.
+- After completing work: run "git add -A && git commit -m 'concise description'".
+- One commit is fine; multiple focused commits are also fine.
+- If the task was already done and you made no changes, just exit cleanly.
+- Run ALL git commands from your current directory — do NOT use absolute paths
+  or "cd <path> && git ...". Your working directory IS the project.
 
 ---
 
-## Final Summary (mandatory)
-
-Before exiting, write a brief summary paragraph (2–5 sentences) describing what you did
-and the outcome. Write it to the path in $CLAUDOMATOR_SUMMARY_FILE:
-
-  echo "Your summary here." > "$CLAUDOMATOR_SUMMARY_FILE"
+## Before Finishing
 
-This summary is displayed in the task UI so the user knows what happened.
+Call report_summary with a brief paragraph describing what you did and the
+outcome. This is shown in the task UI.
 
 ---
 `
diff --git a/internal/executor/preamble_test.go b/internal/executor/preamble_test.go
index 5c31b4f..77a8fca 100644
--- a/internal/executor/preamble_test.go
+++ b/internal/executor/preamble_test.go
@@ -5,27 +5,37 @@ import (
 	"testing"
 )
 
-func TestPlanningPreamble_ContainsFinalSummarySection(t *testing.T) {
-	if !strings.Contains(planningPreamble, "## Final Summary (mandatory)") {
-		t.Error("planningPreamble missing '## Final Summary (mandatory)' heading")
+func TestPlanningPreamble_ReferencesMCPTools(t *testing.T) {
+	for _, tool := range []string{"ask_user", "report_summary", "spawn_subtask", "record_progress"} {
+		if !strings.Contains(planningPreamble, tool) {
+			t.Errorf("planningPreamble should mention the %q tool", tool)
+		}
 	}
 }
 
-func TestPlanningPreamble_SummaryUsesFileEnvVar(t *testing.T) {
-	if !strings.Contains(planningPreamble, "CLAUDOMATOR_SUMMARY_FILE") {
-		t.Error("planningPreamble should instruct agent to write summary to $CLAUDOMATOR_SUMMARY_FILE")
+func TestPlanningPreamble_NoFileEscapeHatches(t *testing.T) {
+	for _, marker := range []string{"CLAUDOMATOR_SUMMARY_FILE", "CLAUDOMATOR_QUESTION_FILE"} {
+		if strings.Contains(planningPreamble, marker) {
+			t.Errorf("planningPreamble should no longer reference %s", marker)
+		}
 	}
 }
 
-func TestPlanningPreamble_SummaryInstructsEchoToFile(t *testing.T) {
-	if !strings.Contains(planningPreamble, `"$CLAUDOMATOR_SUMMARY_FILE"`) {
-		t.Error("planningPreamble should show example of writing to $CLAUDOMATOR_SUMMARY_FILE via echo")
+func TestPlanningPreamble_AskUserEndsTurn(t *testing.T) {
+	if !strings.Contains(planningPreamble, "end your turn") {
+		t.Error("planningPreamble should instruct the agent to end its turn after ask_user")
 	}
 }
 
 func TestPlanningPreamble_GitDiscipline_ForbidsAbsolutePaths(t *testing.T) {
-	// Agents must not bypass the sandbox by using absolute project paths in git commands.
 	if !strings.Contains(planningPreamble, "do NOT use absolute paths") {
 		t.Error("planningPreamble should warn agents not to use absolute paths in git commands")
 	}
 }
+
+func TestWithPlanningPreamble_PrependsToInstructions(t *testing.T) {
+	got := withPlanningPreamble("DO THE THING")
+	if !strings.HasPrefix(got, planningPreamble) || !strings.HasSuffix(got, "DO THE THING") {
+		t.Error("withPlanningPreamble should prepend the preamble to the instructions")
+	}
+}
-- 
cgit v1.2.3


From 65cd7ea65d9c6fe0fad39bb2c5cac70d61153444 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 25 May 2026 19:02:19 +0000
Subject: feat(executor): wire the agent MCP back-channel for gemini containers
 (Phase 4)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

ContainerRunner previously skipped the MCP back-channel for gemini agents, so
they ran tool-less. It now mints a per-task token for gemini too and registers
the agent MCP server in the gemini CLI's user settings
(agentHome/.gemini/settings.json → $HOME/.gemini in-container) using the
gemini-cli mcpServers/httpUrl schema with a bearer header. With MCP enabled,
gemini also receives the planning preamble that points at the ask_user/
report_summary/spawn_subtask/record_progress tools.

Config generation is unit-tested (TestWriteGeminiMCPSettings) and the write is
in the run setup path. CAVEAT: whether the gemini CLI actually invokes these
tools in non-interactive (-p) mode — and how it handles tool auto-approval —
is NOT verified against a live gemini binary in this environment; this lands
the plumbing for a follow-up spike. No regression risk for gemini runs: a
config issue degrades to the prior tool-less behavior.

https://claude.ai/code/session_01SESwn7kQ7oP62trWw6pc39
---
 internal/executor/container.go      | 42 ++++++++++++++++++++++++++++++++++---
 internal/executor/container_test.go | 30 ++++++++++++++++++++++++++
 2 files changed, 69 insertions(+), 3 deletions(-)

(limited to 'internal/executor/container.go')

diff --git a/internal/executor/container.go b/internal/executor/container.go
index 78c3ed7..4f8fa06 100644
--- a/internal/executor/container.go
+++ b/internal/executor/container.go
@@ -306,16 +306,22 @@ func (r *ContainerRunner) runContainer(ctx context.Context, t *task.Task, e *sto
 	}
 
 	// Per-task MCP back-channel: mint a scoped token bound to this run's channel
-	// and write an mcp-config pointing the agent at the host agent MCP server.
+	// and point the agent at the host agent MCP server. Claude reads an
+	// --mcp-config file; the gemini CLI auto-discovers servers from its
+	// ~/.gemini/settings.json (agentHome is the container's $HOME).
 	mcpEnabled := false
-	if r.Registry != nil && t.Agent.Type != "gemini" {
+	if r.Registry != nil {
 		token, mintErr := r.Registry.Mint(ch)
 		if mintErr != nil {
 			return fmt.Errorf("minting agent mcp token: %w", mintErr)
 		}
 		defer r.Registry.Revoke(token)
 		mcpURL := strings.TrimRight(strings.ReplaceAll(r.APIURL, "localhost", "host.docker.internal"), "/") + "/mcp"
-		if err := writeMCPConfig(workspace, mcpURL, token); err != nil {
+		if t.Agent.Type == "gemini" {
+			if err := writeGeminiMCPSettings(agentHome, mcpURL, token); err != nil {
+				return fmt.Errorf("writing gemini mcp settings: %w", err)
+			}
+		} else if err := writeMCPConfig(workspace, mcpURL, token); err != nil {
 			return fmt.Errorf("writing mcp config: %w", err)
 		}
 		mcpEnabled = true
@@ -534,6 +540,36 @@ func writeMCPConfig(workspace, mcpURL, token string) error {
 	return os.WriteFile(filepath.Join(workspace, ".claudomator-mcp.json"), data, 0600)
 }
 
+// writeGeminiMCPSettings registers the per-task agent MCP server in the gemini
+// CLI's user settings (agentHome/.gemini/settings.json, which is $HOME/.gemini
+// in-container). The gemini CLI discovers MCP servers from this file rather than
+// a command-line flag; httpUrl selects the streamable-HTTP transport and headers
+// carry the bearer token.
+//
+// NOTE: the on-disk schema follows the gemini-cli mcpServers format, but whether
+// the CLI actually invokes these tools in non-interactive (-p) mode has not been
+// verified against a live gemini binary — confirm with a spike before relying on
+// gemini tool-use in production.
+func writeGeminiMCPSettings(agentHome, mcpURL, token string) error {
+	cfg := map[string]any{
+		"mcpServers": map[string]any{
+			"claudomator": map[string]any{
+				"httpUrl": mcpURL,
+				"headers": map[string]string{"Authorization": "Bearer " + token},
+			},
+		},
+	}
+	data, err := json.Marshal(cfg)
+	if err != nil {
+		return err
+	}
+	dir := filepath.Join(agentHome, ".gemini")
+	if err := os.MkdirAll(dir, 0755); err != nil {
+		return err
+	}
+	return os.WriteFile(filepath.Join(dir, "settings.json"), data, 0600)
+}
+
 func (r *ContainerRunner) buildInnerCmd(t *task.Task, e *storage.Execution, isResume, mcpEnabled bool) []string {
 	// Claude CLI uses -p for prompt text. To pass a file, we use a shell to cat it.
 	// We use a shell variable to capture the expansion to avoid quoting issues with instructions contents.
diff --git a/internal/executor/container_test.go b/internal/executor/container_test.go
index 3d0887c..521e1cb 100644
--- a/internal/executor/container_test.go
+++ b/internal/executor/container_test.go
@@ -107,6 +107,36 @@ func TestWriteMCPConfig(t *testing.T) {
 	}
 }
 
+func TestWriteGeminiMCPSettings(t *testing.T) {
+	agentHome := t.TempDir()
+	if err := writeGeminiMCPSettings(agentHome, "http://host.docker.internal:8484/mcp", "tok-xyz"); err != nil {
+		t.Fatalf("writeGeminiMCPSettings: %v", err)
+	}
+	data, err := os.ReadFile(filepath.Join(agentHome, ".gemini", "settings.json"))
+	if err != nil {
+		t.Fatalf("read settings: %v", err)
+	}
+	var parsed struct {
+		MCPServers map[string]struct {
+			HTTPURL string            `json:"httpUrl"`
+			Headers map[string]string `json:"headers"`
+		} `json:"mcpServers"`
+	}
+	if err := json.Unmarshal(data, &parsed); err != nil {
+		t.Fatalf("settings is not valid JSON: %v", err)
+	}
+	srv, ok := parsed.MCPServers["claudomator"]
+	if !ok {
+		t.Fatal("expected claudomator server entry")
+	}
+	if srv.HTTPURL != "http://host.docker.internal:8484/mcp" {
+		t.Errorf("unexpected httpUrl: %q", srv.HTTPURL)
+	}
+	if srv.Headers["Authorization"] != "Bearer tok-xyz" {
+		t.Errorf("expected bearer header, got %q", srv.Headers["Authorization"])
+	}
+}
+
 func TestContainerRunner_BuildInnerCmd(t *testing.T) {
 	runner := &ContainerRunner{}
 	
-- 
cgit v1.2.3


From 561915c5182c3fb39cd6a8b6613c489b35b7c1bf Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 26 May 2026 09:28:57 +0000
Subject: fix(executor): set IS_SANDBOX=1 so claude honors bypassPermissions
 under root
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The spike found that `claude --permission-mode bypassPermissions` (emitted by
buildInnerCmd) is rejected when the process runs as root, and buildDockerArgs
maps the container --user to the host uid — which is 0 when claudomator runs as
root, breaking all claude tool execution in production.

The container is an isolated sandbox, exactly the case the claude CLI gates
behind IS_SANDBOX=1; setting it in the container env makes bypassPermissions
work regardless of the host uid. Verified empirically against claude 2.1.150
(rejected as root without it; succeeds with it). Harmless for gemini containers.

https://claude.ai/code/session_01SESwn7kQ7oP62trWw6pc39
---
 internal/executor/container.go      | 4 ++++
 internal/executor/container_test.go | 1 +
 2 files changed, 5 insertions(+)

(limited to 'internal/executor/container.go')

diff --git a/internal/executor/container.go b/internal/executor/container.go
index 4f8fa06..f78715d 100644
--- a/internal/executor/container.go
+++ b/internal/executor/container.go
@@ -496,6 +496,10 @@ func (r *ContainerRunner) buildDockerArgs(workspace, claudeHome, taskID string)
 		"-w", "/workspace",
 		"--env-file", hostEnvFile,
 		"-e", "HOME=/home/agent",
+		// The container is an isolated sandbox; IS_SANDBOX=1 lets the claude CLI
+		// honor --permission-mode bypassPermissions even when the agent runs as
+		// root (buildDockerArgs maps --user to the host uid, which may be 0).
+		"-e", "IS_SANDBOX=1",
 		"-e", "CLAUDOMATOR_API_URL=" + apiURL,
 		"-e", "CLAUDOMATOR_TASK_ID=" + taskID,
 		"-e", "CLAUDOMATOR_DROP_DIR=" + r.DropsDir,
diff --git a/internal/executor/container_test.go b/internal/executor/container_test.go
index 521e1cb..5c3fd2e 100644
--- a/internal/executor/container_test.go
+++ b/internal/executor/container_test.go
@@ -37,6 +37,7 @@ func TestContainerRunner_BuildDockerArgs(t *testing.T) {
 		"-w", "/workspace",
 		"--env-file", "/tmp/ws/.claudomator-env",
 		"-e", "HOME=/home/agent",
+		"-e", "IS_SANDBOX=1",
 		"-e", "CLAUDOMATOR_API_URL=http://host.docker.internal:8484",
 		"-e", "CLAUDOMATOR_TASK_ID=task-123",
 		"-e", "CLAUDOMATOR_DROP_DIR=/data/drops",
-- 
cgit v1.2.3


From 1deee869e5cd0895e45016192dd70c0ed6c68cf3 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Wed, 27 May 2026 05:42:31 +0000
Subject: refactor(executor): retire the file-based question/summary fallback
 (Phase 8)

With the MCP agent channel validated (the spike confirmed real claude calls
ask_user/report_summary through it), the container runner no longer needs the
pre-MCP file fallback that read question.json/summary.txt after the agent
exited. Removes that block and the now-orphaned isCompletionReport/
extractQuestionText helpers and their test. The MCP path
(channelPendingQuestion) is now the sole question/summary transport.

https://claude.ai/code/session_01SESwn7kQ7oP62trWw6pc39
---
 internal/executor/container.go      | 28 -------------------------
 internal/executor/container_test.go | 42 -------------------------------------
 internal/executor/helpers.go        | 26 -----------------------
 3 files changed, 96 deletions(-)

(limited to 'internal/executor/container.go')

diff --git a/internal/executor/container.go b/internal/executor/container.go
index f78715d..3afce70 100644
--- a/internal/executor/container.go
+++ b/internal/executor/container.go
@@ -403,34 +403,6 @@ func (r *ContainerRunner) runContainer(ctx context.Context, t *task.Task, e *sto
 		return &BlockedError{QuestionJSON: q, SessionID: e.SessionID, SandboxDir: workspace}
 	}
 
-	// Check whether the agent left a question before exiting (file fallback for
-	// in-flight tasks started on the pre-MCP wire).
-	questionFile := filepath.Join(logDir, "question.json")
-	if data, readErr := os.ReadFile(questionFile); readErr == nil {
-		os.Remove(questionFile) // consumed
-		questionJSON := strings.TrimSpace(string(data))
-		if isCompletionReport(questionJSON) {
-			r.Logger.Info("treating question file as completion report", "taskID", e.TaskID)
-			_ = ch.ReportSummary(ctx, extractQuestionText(questionJSON))
-		} else {
-			if e.SessionID == "" {
-				r.Logger.Warn("missing session ID; resume will start fresh", "taskID", e.TaskID)
-			}
-			return &BlockedError{
-				QuestionJSON: questionJSON,
-				SessionID:    e.SessionID,
-				SandboxDir:   workspace,
-			}
-		}
-	}
-
-	// Read agent summary if written.
-	summaryFile := filepath.Join(logDir, "summary.txt")
-	if summaryData, readErr := os.ReadFile(summaryFile); readErr == nil {
-		os.Remove(summaryFile) // consumed
-		_ = ch.ReportSummary(ctx, strings.TrimSpace(string(summaryData)))
-	}
-
 	// 5. Post-execution: push changes if successful
 	if waitErr == nil && streamErr == nil {
 		// Check if there are any commits to push (HEAD ahead of origin/HEAD).
diff --git a/internal/executor/container_test.go b/internal/executor/container_test.go
index 5c3fd2e..26e67bc 100644
--- a/internal/executor/container_test.go
+++ b/internal/executor/container_test.go
@@ -269,48 +269,6 @@ func TestBlockedError_IncludesSandboxDir(t *testing.T) {
 	}
 }
 
-func TestIsCompletionReport(t *testing.T) {
-	tests := []struct {
-		name     string
-		json     string
-		expected bool
-	}{
-		{
-			name:     "real question with options",
-			json:     `{"text": "Should I proceed with implementation?", "options": ["Yes", "No"]}`,
-			expected: false,
-		},
-		{
-			name:     "real question no options",
-			json:     `{"text": "Which approach do you prefer?"}`,
-			expected: false,
-		},
-		{
-			name:     "completion report no options no question mark",
-			json:     `{"text": "All tests pass. Implementation complete. Summary written to CLAUDOMATOR_SUMMARY_FILE."}`,
-			expected: true,
-		},
-		{
-			name:     "completion report with empty options",
-			json:     `{"text": "Feature implemented and committed.", "options": []}`,
-			expected: true,
-		},
-		{
-			name:     "invalid json treated as not a report",
-			json:     `not json`,
-			expected: false,
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got := isCompletionReport(tt.json)
-			if got != tt.expected {
-				t.Errorf("isCompletionReport(%q) = %v, want %v", tt.json, got, tt.expected)
-			}
-		})
-	}
-}
-
 func TestTailFile_ReturnsLastNLines(t *testing.T) {
 	f, err := os.CreateTemp("", "tailfile-*")
 	if err != nil {
diff --git a/internal/executor/helpers.go b/internal/executor/helpers.go
index 76bf8b1..9517492 100644
--- a/internal/executor/helpers.go
+++ b/internal/executor/helpers.go
@@ -177,29 +177,3 @@ func gitSafe(args ...string) []string {
 		"-c", "tag.gpgsign=false",
 	}, args...)
 }
-
-// isCompletionReport returns true when a question-file JSON looks like a
-// completion report rather than a real user question. Heuristic: no options
-// (or empty options) and no "?" anywhere in the text.
-func isCompletionReport(questionJSON string) bool {
-	var q struct {
-		Text    string   `json:"text"`
-		Options []string `json:"options"`
-	}
-	if err := json.Unmarshal([]byte(questionJSON), &q); err != nil {
-		return false
-	}
-	return len(q.Options) == 0 && !strings.Contains(q.Text, "?")
-}
-
-// extractQuestionText returns the "text" field from a question-file JSON, or
-// the raw string if parsing fails.
-func extractQuestionText(questionJSON string) string {
-	var q struct {
-		Text string `json:"text"`
-	}
-	if err := json.Unmarshal([]byte(questionJSON), &q); err != nil {
-		return questionJSON
-	}
-	return strings.TrimSpace(q.Text)
-}
-- 
cgit v1.2.3