officerdev/platform
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chat: run Claude un-isolated for the Super Admin (real HOME, ~/.claude parity)

Browse Source 
Single-user platform: the Super Admin's Claude process now uses the real home
(HOME_DIR) instead of DATA_PATH/<email>/home, so its transcript store IS the same
~/.claude the terminal `claude` uses — platform and terminal sessions are
interchangeable (native `/resume` sees them). The session reader resolves the
same home. The generated container CLAUDE.md is no longer written for the Super
Admin (it would pollute the personal global ~/.claude/CLAUDE.md and is stale);
MCP tools still load via --mcp-config, and email/project panels inject their own
prompts. Sandboxed users keep their isolated home.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
pastilhas
2026-07-24 12:19:31 +00:00
co-authored by Claude Opus 4.8
parent b3b8a59863
commit 420aa08783
2 changed files with 21 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/servers/sidecar/claude/user-instance.ts
+15 -5
View File
@@ -1,5 +1,6 @@
import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
import { join, resolve } from 'node:path';
import { homedir } from 'node:os';
import type { SidecarCommand, SidecarEvent } from '../protocol';
import { initPaths, loadState, flushAndSave, acquireLock, releaseLock } from './state';
import { setMcpConfigPath } from './claude-manager';
@@ -31,7 +32,11 @@ const OFFICER_AUTH_TOKEN = await sign(
'30d',
);
const homeDir = join(DATA_PATH, email, 'home');
// Single-user platform: the Super Admin runs Claude with no isolation — real HOME, real ~/.claude —
// so platform sessions have perfect parity with terminal sessions (same config, credentials, and
// transcript store, interchangeable via `claude --resume`). Any non-super-admin keeps an isolated home.
const homeDir =
dbUser.role === 'Super Admin' ? (process.env.HOME_DIR ?? homedir()) : join(DATA_PATH, email, 'home');
const globalToolsDir = join(DATA_PATH, 'tools');
const userToolsDir = join(DATA_PATH, email, 'tools');
@@ -123,10 +128,15 @@ function generateMcpConfig(): McpPaths {
// ── Startup ──
try {
refreshClaudeMd();
} catch (err) {
console.error(`[claude:${email}] failed to refresh CLAUDE.md:`, err instanceof Error ? err.message : err);
// Only sandboxed users get the generated container CLAUDE.md. For the un-isolated Super Admin, HOME is
// the real home, so writing it there would pollute the personal global ~/.claude/CLAUDE.md (loaded by
// the terminal `claude` too) — parity means running as the user, not injecting platform context.
if (dbUser.role !== 'Super Admin') {
try {
refreshClaudeMd();
} catch (err) {
console.error(`[claude:${email}] failed to refresh CLAUDE.md:`, err instanceof Error ? err.message : err);
}
}
const mcpPaths = generateMcpConfig();