ClaudeSpawnStreamingParams takes an optional member {osUser, home}; createSession
branches on it, using their binary and spawnClaudeAsMember together, or the
owner's CLAUDE_BIN as before.
THE BINARY AND THE PRIVILEGE DROP ARE ONE BRANCH ON PURPOSE. settingSources
makes ~/.claude authoritative for settings and ~ is whatever HOME the process
gets, so pointing the SDK at a member's binary while spawning as the service
user would read the OWNER'S settings and credential while running the member's
code — and it would look like it worked.
cwd defaults to member.home before HOST_HOME for the same reason: HOST_HOME is
this process's home, so a member would start in a directory they cannot read and
the failure would present as a broken agent rather than a wrong cwd.
Nothing populates `member`. Both gates refuse non-owners before any of this is
reached, so the delta is that spawnClaudeAsMember now has two importers instead
of one, and neither path a user can take changes. Verified rather than assumed,
since host made it a condition: both gates intact, 84 tests pass.
Not authorization: host gave an opinion on wire-first and deferred to the owner,
who has not ruled. Corrected in COMMS, where 01 had overstated it. The gates
come off on the owner's word alone; this reverts as one commit if the answer is
no.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
host's finding on 288679af, and the directory restructure the owner asked for.
THE MARKERS WERE SUBSTRINGS OF THE PATHS THEY TESTED. `bin` is inside
…/.local/bin/claude and `cred` is inside …/.claude/.credentials.json, and the
match ran against a string that merged stdout and stderr — so anything writing
either path to stderr set the flag. Verified on the live server against an
account with neither file: one `set -x` made the trace of the test command
itself report installed and signed in. Not live, and it fails in the unsafe
direction, on the endpoint whose whole job is explaining a broken agent.
No marker spelling fixes it, because a trace echoes the literal along with the
path. The channel was the bug. Two characters on stdout read by position, with
parsing extracted as parseLoginProbe so it cannot see stderr at all, and stderr
kept separately because a failure has to stay diagnosable. Seven tests including
the exact trace host captured — true/true before, false/false now.
COMMS is renumbered: ten dated files in a day, each restating the others'
status, replaced by one file holding only what nobody has resolved. Odd numbers
mine, even numbers host's, alternation encoding push-then-wait, numbers ending
when the feature does. The reasoning that produced the deleted files is in the
commit history, which is where it belongs.
Carried forward and unowned: deprovisionOsAccount, the terminal replay bug, the
two docker handbacks, and the two verify items neither of us can execute.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
pastilhasandClaude Opus 5