Mudroom

Fix mudroom init: skip writeStarterConfig when .mudroom.yaml already exists so hook reinstall works without -f

Fix session handoff: add missing --origin arg and context-aware SWAMP_REPO_DIR in Stop hook; add host→guest .jsonl bridge in claimStage

Hotfix for 2026.05.18.64: the revert missed three multi-line container-exec arrays in auth.ts (credsScript, settingsScript, teamsScript), so the .64 build still pinned --user node on those three injection paths. Result: Claude credentials, default settings, and Linear-MCP teams patch were silently written to /home/node/.claude/ in containers whose bind mounts targeted /root, never reaching Claude on launch — surfaced as the first-run theme/welcome screen. Lint test strengthened to whole-file scan so future array splits cannot hide the same regression. Yanking .64.

Revert: container exec no longer runs as --user node. The .61/.62/.63 series tried to switch the guest user to node so HOME matched the bind-mount target /home/node/.claude/projects; the cascading work (auth.ts inject paths, /home/node/.claude ownership) made it strictly worse than the simpler alternative. Now the bind-mount targets are /root/.claude/projects and /root/.swamp/source, every guest exec runs as the container default (root), and auth.ts is untouched. Session handoff (mudroom resume-host, mudroom doctor, exit-time hint) is preserved. Sandboxes from .60-.63 should still mudroom destroy && mudroom once after upgrading so the fresh container picks up the new mount target.

Fix for 2026.05.18.62: provisionGuest now chowns /home/node/.claude and /home/node/.config{,/swamp,/gh}/aws back to node:node before any auth injection. apple/container creates the intermediate parents of bind-mounted paths (e.g. /home/node/.claude/projects) as root, which silently broke 'cat > /home/node/.claude/.credentials.json' from a --user node exec — surfaced as 'mudroom: injectClaudeAuth failed'. Non-recursive on .claude so the host-shared /home/node/.claude/projects mount keeps its real ownership. Existing sandboxes can heal in place with: container exec --user 0 chown node:node /home/node/.claude /home/node/.config /home/node/.aws — or just mudroom destroy && mudroom.

Fix follow-up to 2026.05.18.61: credential injection methods (injectSwampAuth, injectGhAuth, injectGitIdentity, injectClaudeAuth, injectLinearMcp, injectAwsAuth) now also exec as --user node so their writes land in /home/node/.claude, /home/node/.config, etc. — where claude (which now runs as node) actually reads from. Without this, mudroom 2026.05.18.61 silently dropped Claude creds, gh auth, git identity, swamp auth, Linear MCP, and AWS creds inside the guest. Existing sandboxes still need a one-time mudroom destroy && mudroom after upgrading.

Fix Aapple/container exec now runs as the node user so Claude session jsonls land in the per-sandbox bind mount instead of /root/.claude/projects. Adds mudroom resume-host (bridges guest sessions for native claude --resume on the host) and mudroom doctor (diagnoses stop-hook, sessionsHost config, sessions dir, and runtime user). Existing sandboxes must be recreated once: mudroom destroy && mudroom.