From 00ccb9ec74d7fabcb84376bff69d19cf3cb5720c Mon Sep 17 00:00:00 2001
From: Alastair Drong <adrong@gmail.com>
Date: Tue, 28 Jul 2026 13:48:26 -0700
Subject: [PATCH 1/6] Seed initial build prompt for new apps only
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When a user creates a new app, the form description reached the build
session only as the APP_DESCRIPTION env var, which the pod's CLAUDE.md
merely *instructs* Claude to read — not guaranteed on turn one, so a
carefully-described app could sit idle until the user re-typed it.

Seed the description as Claude's opening prompt so a new app builds to
spec immediately. Gate it strictly to brand-new apps: an existing-app
"Build" session has no form, its description is back-filled from the
app's stored sus.json (possibly stale), and the user is about to say
what they want — auto-kicking a build there would risk clobbering
intentional changes or nagging about outgrown specs.

Detection uses the absence of sus.json (the existing scaffold gate),
which is restart-safe: a recreated pod re-clones the committed scaffold
so NEW_APP reads 0 and we don't re-kick on restart. The untrusted
description is passed via an exported env var and expanded by the inner
shell as a single quoted arg (never spliced into the command string),
so it cannot break quoting or inject shell — verified with a hostile
description containing quotes, $(...), backticks, and newlines.

Also soften CLAUDE.md so resumed sessions treat the description as
background rather than a spec to enforce.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 build-pod/CLAUDE.md     |  5 ++++-
 build-pod/entrypoint.sh | 32 +++++++++++++++++++++++++++++---
 2 files changed, 33 insertions(+), 4 deletions(-)

diff --git a/build-pod/CLAUDE.md b/build-pod/CLAUDE.md
index 6759d0d..f98f22d 100644
--- a/build-pod/CLAUDE.md
+++ b/build-pod/CLAUDE.md
@@ -61,7 +61,10 @@ Check these environment variables for context about what you're building:
 - `APP_NAME` — the human-readable app name (if set)
 - `APP_DESCRIPTION` — what the app should do (if set)
 
-If `APP_DESCRIPTION` is set, use it as your starting context. The user expects the app to match this description. If the current state of the app doesn't match, proactively offer to fix it.
+If `APP_DESCRIPTION` is set, treat it as helpful background about what the app was originally meant to do.
+
+- **Brand-new app:** you'll receive an initial instruction to build it — follow that and get a working first version into the preview right away.
+- **Existing app you're resuming:** the description may be the *original* spec, and the app may have intentionally moved on from it. Don't assume any difference is a mistake, and don't start changing things unprompted. Wait for the user to tell you what they want; only offer to align the app with the description if it seems genuinely relevant.
 
 ---
 
diff --git a/build-pod/entrypoint.sh b/build-pod/entrypoint.sh
index 6210e27..5c8e5e1 100755
--- a/build-pod/entrypoint.sh
+++ b/build-pod/entrypoint.sh
@@ -70,8 +70,13 @@ fi
 APP_DIR="/repo/${APP_TEAM:-_new}/${APP_SLUG:-_new}"
 mkdir -p "$APP_DIR"
 
-# If this is a new app, create a minimal sus.json.
+# If this is a new app, create a minimal sus.json. The absence of sus.json is
+# also our "brand-new app" signal (an existing app's clone brings its own down),
+# and it's restart-safe: a recreated pod re-clones the now-committed scaffold, so
+# NEW_APP reads 0 and we don't re-kick a build on restart.
+NEW_APP=0
 if [ ! -f "$APP_DIR/sus.json" ]; then
+    NEW_APP=1
     cat > "$APP_DIR/sus.json" <<SUSJSON
 {
   "name": "${APP_NAME:-New App}",
@@ -257,5 +262,26 @@ with open(path, "w") as f:
     json.dump(data, f)
 PYEOF
 
-exec ttyd --port 8080 --writable --base-path / \
-    bash -c "cd '$APP_DIR' && exec claude --dangerously-skip-permissions --model '${CLAUDE_MODEL:-opus}'"
+# For a brand-new app with a description, seed an initial prompt so Claude
+# starts building to spec on the first turn — otherwise the form description
+# only reaches the session as an env var the CLAUDE.md *asks* Claude to read,
+# which isn't guaranteed. Gated to NEW_APP: an existing-app "Build" session
+# must NOT be auto-kicked — its sus.json description may be stale and the user
+# is about to say what they want.
+#
+# The description is untrusted user input, so it is passed via an exported env
+# var and expanded by the INNER shell as a single quoted argument (note the
+# escaped \$SUS_INITIAL_PROMPT). It is never spliced into the command string,
+# so it cannot break quoting or inject shell.
+if [ "${NEW_APP:-0}" = "1" ] && [ -n "${APP_DESCRIPTION:-}" ]; then
+    export SUS_INITIAL_PROMPT="Build this app now and show it in the preview pane on the right. Here is what it should do:
+
+${APP_DESCRIPTION}
+
+Create the initial working version straight away, then tell me it's ready."
+    exec ttyd --port 8080 --writable --base-path / \
+        bash -c "cd '$APP_DIR' && exec claude --dangerously-skip-permissions --model '${CLAUDE_MODEL:-opus}' \"\$SUS_INITIAL_PROMPT\""
+else
+    exec ttyd --port 8080 --writable --base-path / \
+        bash -c "cd '$APP_DIR' && exec claude --dangerously-skip-permissions --model '${CLAUDE_MODEL:-opus}'"
+fi

From 07c47ffa639e2e7352b56771550d7c6537e19966 Mon Sep 17 00:00:00 2001
From: Alastair Drong <adrong@gmail.com>
Date: Wed, 29 Jul 2026 10:49:30 -0700
Subject: [PATCH 2/6] Fix seed re-firing on reconnect; write scaffold sus.json
 via json.dump
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Addresses the #96 review findings.

1. BLOCKING — seed was not one-shot. ttyd spawns a fresh `claude` per
   *client connection*, and the frontend reconnects on its own (terminal
   iframe reload on a not-ready blip, full page reload after ~15s, manual
   refresh, second tab). Baking the prompt into the ttyd command re-fired
   "build the initial version" on every reconnect — potentially over an
   app the user had been iterating on for an hour, with autosave committing
   the clobber. NEW_APP is fixed for the pod lifetime so it can't gate this.
   Fix: drop the prompt in a seed file and have the inner per-connection
   shell claim it with an atomic `mv` that succeeds exactly once; later
   connections fall through to a plain interactive session. Verified
   one-shot across sequential reconnects and exactly-once under 8 concurrent
   connections; injection safety preserved (hostile description reaches
   claude as a single "$(cat)" word).

2. Scaffold sus.json now uses python3 json.dump instead of a heredoc.
   APP_DESCRIPTION is a free-form <textarea>; a quote or newline spliced
   into hand-written JSON produced an invalid manifest, which catalog.py
   silently drops from the listing. Verified valid JSON with a description
   containing quotes, newlines and backslashes.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 build-pod/entrypoint.sh | 85 ++++++++++++++++++++++++++++-------------
 1 file changed, 58 insertions(+), 27 deletions(-)

diff --git a/build-pod/entrypoint.sh b/build-pod/entrypoint.sh
index 5c8e5e1..28a043c 100755
--- a/build-pod/entrypoint.sh
+++ b/build-pod/entrypoint.sh
@@ -77,18 +77,25 @@ mkdir -p "$APP_DIR"
 NEW_APP=0
 if [ ! -f "$APP_DIR/sus.json" ]; then
     NEW_APP=1
-    cat > "$APP_DIR/sus.json" <<SUSJSON
-{
-  "name": "${APP_NAME:-New App}",
-  "description": "${APP_DESCRIPTION:-}",
-  "owner": "${USER_ID:-anonymous}",
-  "team": "${APP_TEAM:-_new}",
-  "created_at": "$(date -u +%Y-%m-%d)",
-  "visibility": ["default"],
-  "default_stack": "python+htmx",
-  "tags": []
+    # Build the manifest with json.dump, not a heredoc: APP_NAME and especially
+    # APP_DESCRIPTION are free-form user input (a <textarea>), so a quote or
+    # newline spliced into hand-written JSON yields an invalid sus.json — and
+    # catalog.py silently drops apps whose manifest won't parse.
+    APP_DIR="$APP_DIR" python3 - <<'PYEOF'
+import datetime, json, os
+data = {
+    "name": os.environ.get("APP_NAME") or "New App",
+    "description": os.environ.get("APP_DESCRIPTION", ""),
+    "owner": os.environ.get("USER_ID") or "anonymous",
+    "team": os.environ.get("APP_TEAM") or "_new",
+    "created_at": datetime.datetime.now(datetime.timezone.utc).strftime("%Y-%m-%d"),
+    "visibility": ["default"],
+    "default_stack": "python+htmx",
+    "tags": [],
 }
-SUSJSON
+with open(os.path.join(os.environ["APP_DIR"], "sus.json"), "w") as f:
+    json.dump(data, f, indent=2)
+PYEOF
     git add -A 2>/dev/null || true
     git commit -m "chore: scaffold ${APP_TEAM:-_new}/${APP_SLUG:-_new}" 2>/dev/null || true
 fi
@@ -262,26 +269,50 @@ with open(path, "w") as f:
     json.dump(data, f)
 PYEOF
 
-# For a brand-new app with a description, seed an initial prompt so Claude
+# For a brand-new app with a description, hand Claude an initial prompt so it
 # starts building to spec on the first turn — otherwise the form description
-# only reaches the session as an env var the CLAUDE.md *asks* Claude to read,
-# which isn't guaranteed. Gated to NEW_APP: an existing-app "Build" session
-# must NOT be auto-kicked — its sus.json description may be stale and the user
-# is about to say what they want.
+# only reaches the session as an env var CLAUDE.md *asks* Claude to read, which
+# isn't guaranteed. Gated to NEW_APP: an existing-app "Build" session must NOT
+# be auto-kicked — its sus.json description may be stale and the user is about
+# to say what they want.
+#
+# One-shot, and this matters: ttyd spawns a fresh `claude` per *client
+# connection*, and the frontend reconnects on its own (terminal-iframe reload on
+# a not-ready blip, a full page reload after ~15s, a manual refresh, a second
+# tab). If every connection were seeded, a reconnect hours into a session would
+# re-run "build the initial version" over the user's work — and autosave would
+# commit the clobber. So we drop the prompt in a seed file and let the inner
+# shell claim it with an atomic `mv` that succeeds exactly once: only the first
+# connection is seeded; every later one falls through to a plain interactive
+# session. (NEW_APP alone can't gate this — it's fixed for the pod's lifetime.)
 #
-# The description is untrusted user input, so it is passed via an exported env
-# var and expanded by the INNER shell as a single quoted argument (note the
-# escaped \$SUS_INITIAL_PROMPT). It is never spliced into the command string,
-# so it cannot break quoting or inject shell.
+# APP_DESCRIPTION is untrusted: it's expanded into the seed file by the heredoc
+# (bash does not re-scan an expansion's contents) and reaches claude as a single
+# "$(cat …)" word — never spliced into the command string, so it cannot break
+# quoting or inject shell.
 if [ "${NEW_APP:-0}" = "1" ] && [ -n "${APP_DESCRIPTION:-}" ]; then
-    export SUS_INITIAL_PROMPT="Build this app now and show it in the preview pane on the right. Here is what it should do:
+    SUS_SEED_FILE=/tmp/sus-initial-prompt
+    cat > "$SUS_SEED_FILE" <<SEEDEOF
+Build this app now and show it in the preview pane on the right. Here is what it should do:
 
 ${APP_DESCRIPTION}
 
-Create the initial working version straight away, then tell me it's ready."
-    exec ttyd --port 8080 --writable --base-path / \
-        bash -c "cd '$APP_DIR' && exec claude --dangerously-skip-permissions --model '${CLAUDE_MODEL:-opus}' \"\$SUS_INITIAL_PROMPT\""
-else
-    exec ttyd --port 8080 --writable --base-path / \
-        bash -c "cd '$APP_DIR' && exec claude --dangerously-skip-permissions --model '${CLAUDE_MODEL:-opus}'"
+Create the initial working version straight away, then tell me it's ready.
+SEEDEOF
+    export SUS_SEED_FILE
 fi
+
+export APP_DIR
+export CLAUDE_MODEL="${CLAUDE_MODEL:-opus}"
+# Single-quoted on purpose: $APP_DIR/$SUS_SEED_FILE/$CLAUDE_MODEL and the
+# $(cat …) must be evaluated by the inner per-connection shell (so the mv/cat
+# run once per connection), not baked in once by this shell at exec time.
+# shellcheck disable=SC2016
+exec ttyd --port 8080 --writable --base-path / \
+    bash -c '
+        cd "$APP_DIR" || exit 1
+        if [ -n "${SUS_SEED_FILE:-}" ] && mv "$SUS_SEED_FILE" "$SUS_SEED_FILE.used" 2>/dev/null; then
+            exec claude --dangerously-skip-permissions --model "$CLAUDE_MODEL" "$(cat "$SUS_SEED_FILE.used")"
+        fi
+        exec claude --dangerously-skip-permissions --model "$CLAUDE_MODEL"
+    '

From 6441d761256cbfc0282659065ff149ed3ce7f8d6 Mon Sep 17 00:00:00 2001
From: Alastair Drong <adrong@gmail.com>
Date: Wed, 29 Jul 2026 10:57:29 -0700
Subject: [PATCH 3/6] Re-arm one-shot seed until first file; trailing newline
 in scaffold
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Addresses the #96 re-review's remaining finding: the seed was consumed
by the first connection *attempted*, not the first that survives. An
early frontend reconnect (health-watch starts ~5s in) SIGHUPs the still-
building claude before it writes anything; the replacement session found
the seed already consumed and fell through to plain — leaving a half-
scaffolded app and an idle prompt, in exactly the first-minute window
this feature targets.

Re-arm: before consuming the seed, if it was previously consumed AND the
app dir still holds nothing but sus.json (no user work), restore it. Once
Claude writes any file the re-arm stops firing, so the clobber protection
is unchanged where it matters. Verified: fresh -> seeded, early reconnect
before any file -> re-seeded, reconnect after a file exists -> plain.

Also emit a trailing newline after json.dump so scaffold commits don't
carry 'No newline at end of file'.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 build-pod/entrypoint.sh | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/build-pod/entrypoint.sh b/build-pod/entrypoint.sh
index 28a043c..12d1e55 100755
--- a/build-pod/entrypoint.sh
+++ b/build-pod/entrypoint.sh
@@ -95,6 +95,7 @@ data = {
 }
 with open(os.path.join(os.environ["APP_DIR"], "sus.json"), "w") as f:
     json.dump(data, f, indent=2)
+    f.write("\n")
 PYEOF
     git add -A 2>/dev/null || true
     git commit -m "chore: scaffold ${APP_TEAM:-_new}/${APP_SLUG:-_new}" 2>/dev/null || true
@@ -311,6 +312,16 @@ export CLAUDE_MODEL="${CLAUDE_MODEL:-opus}"
 exec ttyd --port 8080 --writable --base-path / \
     bash -c '
         cd "$APP_DIR" || exit 1
+        # Re-arm a seed consumed by a connection that died before Claude wrote
+        # anything — e.g. an early frontend reconnect (health-watch starts ~5s
+        # in) SIGHUPs the still-building session. Safe precisely because "nothing
+        # but sus.json in the app dir" means there is no user work to clobber;
+        # once Claude has written any file this stops firing and the one-shot
+        # guarantee holds for the rest of the session.
+        if [ -n "${SUS_SEED_FILE:-}" ] && [ -f "$SUS_SEED_FILE.used" ] \
+           && [ -z "$(ls -A . 2>/dev/null | grep -v "^sus\.json$")" ]; then
+            mv "$SUS_SEED_FILE.used" "$SUS_SEED_FILE" 2>/dev/null || true
+        fi
         if [ -n "${SUS_SEED_FILE:-}" ] && mv "$SUS_SEED_FILE" "$SUS_SEED_FILE.used" 2>/dev/null; then
             exec claude --dangerously-skip-permissions --model "$CLAUDE_MODEL" "$(cat "$SUS_SEED_FILE.used")"
         fi

From 77aac404c89d844fc34e78225131f4e7123c2ca7 Mon Sep 17 00:00:00 2001
From: Alastair Drong <adrong@gmail.com>
Date: Wed, 29 Jul 2026 11:04:38 -0700
Subject: [PATCH 4/6] Guard seed re-arm with a liveness check to prevent
 concurrent double-builds
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The re-arm added last commit asked only 'is the app dir still empty', not
'is the previous build dead'. So a second client arriving before the first
build writes a file — a new tab, or a reconnect that beats SIGHUP to the
old claude — would re-arm and launch a second --dangerously-skip-permissions
build racing over the same directory.

Record the claiming shell's pid (which becomes claude via exec) and only
re-arm when that pid is no longer alive (kill -0; kill is a builtin, procps
isn't in the image). This is orthogonal to the sequential early-death case
the re-arm targets — there the prior session is dead by definition, so the
guard passes and re-seeding still works.

Verified: fresh -> seeded; second connection while the build is alive ->
plain (no double build); after the builder dies with no files written ->
re-seeded; after any file exists -> plain.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 build-pod/entrypoint.sh | 24 +++++++++++++++++-------
 1 file changed, 17 insertions(+), 7 deletions(-)

diff --git a/build-pod/entrypoint.sh b/build-pod/entrypoint.sh
index 12d1e55..1cbd2c0 100755
--- a/build-pod/entrypoint.sh
+++ b/build-pod/entrypoint.sh
@@ -312,17 +312,27 @@ export CLAUDE_MODEL="${CLAUDE_MODEL:-opus}"
 exec ttyd --port 8080 --writable --base-path / \
     bash -c '
         cd "$APP_DIR" || exit 1
-        # Re-arm a seed consumed by a connection that died before Claude wrote
-        # anything — e.g. an early frontend reconnect (health-watch starts ~5s
-        # in) SIGHUPs the still-building session. Safe precisely because "nothing
-        # but sus.json in the app dir" means there is no user work to clobber;
-        # once Claude has written any file this stops firing and the one-shot
-        # guarantee holds for the rest of the session.
+        # Re-arm a seed consumed by a session that died before Claude wrote
+        # anything (e.g. an early frontend reconnect SIGHUPs the still-building
+        # claude), so the replacement connection still gets kicked. Two guards
+        # keep this from starting a *second concurrent* build:
+        #   - the app dir must still hold nothing but sus.json (no user work), and
+        #   - the previous claimant must be dead — kill -0 on the pid it recorded
+        #     (kill is a bash builtin; procps/pgrep are not in the image).
+        # Without the liveness check a second client (a new tab, or a reconnect
+        # that beats SIGHUP to the old claude) would re-arm while the first build
+        # is still running and launch another --dangerously-skip-permissions build
+        # over the same dir. Once Claude writes any file the re-arm stops firing
+        # and the seed is one-shot for the rest of the session.
         if [ -n "${SUS_SEED_FILE:-}" ] && [ -f "$SUS_SEED_FILE.used" ] \
-           && [ -z "$(ls -A . 2>/dev/null | grep -v "^sus\.json$")" ]; then
+           && [ -z "$(ls -A . 2>/dev/null | grep -v "^sus\.json$")" ] \
+           && ! { [ -f "$SUS_SEED_FILE.pid" ] && kill -0 "$(cat "$SUS_SEED_FILE.pid" 2>/dev/null)" 2>/dev/null; }; then
             mv "$SUS_SEED_FILE.used" "$SUS_SEED_FILE" 2>/dev/null || true
         fi
         if [ -n "${SUS_SEED_FILE:-}" ] && mv "$SUS_SEED_FILE" "$SUS_SEED_FILE.used" 2>/dev/null; then
+            # $$ is this shell, which becomes claude via exec — so the pid file
+            # tracks the live build for the liveness check above.
+            echo "$$" > "$SUS_SEED_FILE.pid"
             exec claude --dangerously-skip-permissions --model "$CLAUDE_MODEL" "$(cat "$SUS_SEED_FILE.used")"
         fi
         exec claude --dangerously-skip-permissions --model "$CLAUDE_MODEL"

From b61633eede9614166908114dcd0bfd95b42dcc65 Mon Sep 17 00:00:00 2001
From: Alastair Drong <adrong@gmail.com>
Date: Wed, 29 Jul 2026 11:11:15 -0700
Subject: [PATCH 5/6] Close re-arm TOCTOU: require a recorded-and-dead pid, not
 just pid-absence
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The claim mv and the pid write are not atomic, so there is a sub-ms window
where $SUS_SEED_FILE.used exists but the .pid is not written yet. The prior
guard treated a missing .pid as 'claimant dead' and would re-arm there,
re-opening the concurrent double-build this was meant to close. Require
.pid to exist AND its pid to be dead before re-arming; a missing .pid now
means 'claim in flight' (live claimant) and is left alone. A builder that
dies in that sub-ms gap degrades to a plain session, never a double build.

Verified by running the actual shipped bash -c body through the matrix:
TOCTOU window -> plain, fresh -> seeded, second connection while alive ->
plain, dead-with-no-files -> re-seeded, post-work -> plain, existing app ->
plain. (Also caught + fixed an apostrophe in the inner comment that would
have terminated the single-quoted bash -c string — bash -n now clean.)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 build-pod/entrypoint.sh | 27 +++++++++++++++------------
 1 file changed, 15 insertions(+), 12 deletions(-)

diff --git a/build-pod/entrypoint.sh b/build-pod/entrypoint.sh
index 1cbd2c0..4fc9ee7 100755
--- a/build-pod/entrypoint.sh
+++ b/build-pod/entrypoint.sh
@@ -314,19 +314,22 @@ exec ttyd --port 8080 --writable --base-path / \
         cd "$APP_DIR" || exit 1
         # Re-arm a seed consumed by a session that died before Claude wrote
         # anything (e.g. an early frontend reconnect SIGHUPs the still-building
-        # claude), so the replacement connection still gets kicked. Two guards
-        # keep this from starting a *second concurrent* build:
-        #   - the app dir must still hold nothing but sus.json (no user work), and
-        #   - the previous claimant must be dead — kill -0 on the pid it recorded
-        #     (kill is a bash builtin; procps/pgrep are not in the image).
-        # Without the liveness check a second client (a new tab, or a reconnect
-        # that beats SIGHUP to the old claude) would re-arm while the first build
-        # is still running and launch another --dangerously-skip-permissions build
-        # over the same dir. Once Claude writes any file the re-arm stops firing
-        # and the seed is one-shot for the rest of the session.
+        # claude), so the replacement connection still gets kicked. Re-arm only
+        # when ALL hold, or we risk launching a *second concurrent*
+        # --dangerously-skip-permissions build over the same dir:
+        #   - a claim happened ($SUS_SEED_FILE.used exists),
+        #   - the claimant recorded its pid AND that pid is now dead — kill -0
+        #     (a bash builtin; procps/pgrep are not in the image). A *missing*
+        #     .pid means a claim is mid-flight (the mv below and the pid write
+        #     are not atomic), i.e. a live claimant, so we must NOT treat its
+        #     absence as death, and
+        #   - the app dir still holds nothing but sus.json (no user work).
+        # Once Claude writes any file the re-arm stops firing and the seed is
+        # one-shot for the rest of the session.
         if [ -n "${SUS_SEED_FILE:-}" ] && [ -f "$SUS_SEED_FILE.used" ] \
-           && [ -z "$(ls -A . 2>/dev/null | grep -v "^sus\.json$")" ] \
-           && ! { [ -f "$SUS_SEED_FILE.pid" ] && kill -0 "$(cat "$SUS_SEED_FILE.pid" 2>/dev/null)" 2>/dev/null; }; then
+           && [ -f "$SUS_SEED_FILE.pid" ] \
+           && ! kill -0 "$(cat "$SUS_SEED_FILE.pid" 2>/dev/null)" 2>/dev/null \
+           && [ -z "$(ls -A . 2>/dev/null | grep -v "^sus\.json$")" ]; then
             mv "$SUS_SEED_FILE.used" "$SUS_SEED_FILE" 2>/dev/null || true
         fi
         if [ -n "${SUS_SEED_FILE:-}" ] && mv "$SUS_SEED_FILE" "$SUS_SEED_FILE.used" 2>/dev/null; then

From 9c80f1e0e23ebb3d0fd566f2327cb7b4a604a465 Mon Sep 17 00:00:00 2001
From: Alastair Drong <adrong@gmail.com>
Date: Wed, 29 Jul 2026 16:09:07 -0700
Subject: [PATCH 6/6] Simplify seed to plain one-shot; drop the re-arm
 machinery
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The re-arm (restore the seed if an early reconnect killed the build before
it wrote a file) turned a one-line convenience into a four-state protocol
with a liveness check, and every review round surfaced another race in it
(pid TOCTOU, stale pid, ...). It's not worth it for a first-turn nicety.

Keep only the part that matters: consume the seed with an atomic mv that
succeeds exactly once, so the first connection is seeded and reconnects
never re-run the build over the user's work. If an early blip kills the
first build before any file is written, the replacement session is plain
and the user simply restates the request — non-destructive, and still
strictly better than main (which never seeds at all).

Removing the re-arm deletes the entire concurrent-double-build race class
the last three rounds chased. Verified against the shipped bash -c body:
fresh -> seeded, reconnect -> plain, 8 concurrent -> exactly one seeded,
existing app -> plain, hostile description stays a single argv word.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 build-pod/entrypoint.sh | 42 ++++++++++++++++-------------------------
 1 file changed, 16 insertions(+), 26 deletions(-)

diff --git a/build-pod/entrypoint.sh b/build-pod/entrypoint.sh
index 4fc9ee7..5ba80ae 100755
--- a/build-pod/entrypoint.sh
+++ b/build-pod/entrypoint.sh
@@ -305,37 +305,27 @@ fi
 
 export APP_DIR
 export CLAUDE_MODEL="${CLAUDE_MODEL:-opus}"
-# Single-quoted on purpose: $APP_DIR/$SUS_SEED_FILE/$CLAUDE_MODEL and the
-# $(cat …) must be evaluated by the inner per-connection shell (so the mv/cat
-# run once per connection), not baked in once by this shell at exec time.
+# ttyd spawns a fresh `claude` per client connection, so consume the seed with
+# an atomic `mv` that succeeds exactly once: the first connection is seeded,
+# every later one (reconnect, refresh, second tab) falls through to a plain
+# interactive session and never re-runs the build over the user's work.
+#
+# Deliberately NOT recovered: if an early reconnect kills the very first build
+# before it writes a file, the replacement session is plain and the user just
+# restates the request. Auto-recovering that (re-arming the seed) needs a
+# claimant-liveness protocol whose races aren't worth it for a first-turn
+# convenience — a plain session is a fine, non-destructive fallback.
+#
+# Single-quoted body on purpose: $APP_DIR/$SUS_SEED_FILE/$CLAUDE_MODEL and the
+# $(cat …) are evaluated by the inner per-connection shell, not baked in once
+# by this shell at exec time. The untrusted description lives only in the seed
+# file and reaches claude as a single "$(cat …)" argv word — never spliced into
+# the command string, so it can't break quoting or inject shell.
 # shellcheck disable=SC2016
 exec ttyd --port 8080 --writable --base-path / \
     bash -c '
         cd "$APP_DIR" || exit 1
-        # Re-arm a seed consumed by a session that died before Claude wrote
-        # anything (e.g. an early frontend reconnect SIGHUPs the still-building
-        # claude), so the replacement connection still gets kicked. Re-arm only
-        # when ALL hold, or we risk launching a *second concurrent*
-        # --dangerously-skip-permissions build over the same dir:
-        #   - a claim happened ($SUS_SEED_FILE.used exists),
-        #   - the claimant recorded its pid AND that pid is now dead — kill -0
-        #     (a bash builtin; procps/pgrep are not in the image). A *missing*
-        #     .pid means a claim is mid-flight (the mv below and the pid write
-        #     are not atomic), i.e. a live claimant, so we must NOT treat its
-        #     absence as death, and
-        #   - the app dir still holds nothing but sus.json (no user work).
-        # Once Claude writes any file the re-arm stops firing and the seed is
-        # one-shot for the rest of the session.
-        if [ -n "${SUS_SEED_FILE:-}" ] && [ -f "$SUS_SEED_FILE.used" ] \
-           && [ -f "$SUS_SEED_FILE.pid" ] \
-           && ! kill -0 "$(cat "$SUS_SEED_FILE.pid" 2>/dev/null)" 2>/dev/null \
-           && [ -z "$(ls -A . 2>/dev/null | grep -v "^sus\.json$")" ]; then
-            mv "$SUS_SEED_FILE.used" "$SUS_SEED_FILE" 2>/dev/null || true
-        fi
         if [ -n "${SUS_SEED_FILE:-}" ] && mv "$SUS_SEED_FILE" "$SUS_SEED_FILE.used" 2>/dev/null; then
-            # $$ is this shell, which becomes claude via exec — so the pid file
-            # tracks the live build for the liveness check above.
-            echo "$$" > "$SUS_SEED_FILE.pid"
             exec claude --dangerously-skip-permissions --model "$CLAUDE_MODEL" "$(cat "$SUS_SEED_FILE.used")"
         fi
         exec claude --dangerously-skip-permissions --model "$CLAUDE_MODEL"