multi-agent-mux/.agents/reports/canary-projects-multi-agent-mux-creator-claude/report-dafd1df7.md

Code Review: .agents/skills/lib.sh — write-isolation redesign (cp -a) implementing refined plan

Scope

This diff (f2e23c1..ea863c0, 35 insertions/17 deletions) is the cumulative diff against the last commit — it folds together the original agy TOS-seeding work already reviewed three times (b803c6e5, afd375ef, 8f8b6d63), and implements the write-isolation redesign proposed in the Planner's refined plan (Job fd3ba323), which itself responded to a Creator challenge about two issues:

1. Symlinking mutable single-source-of-truth preference/state files causes cross-session/host state corruption.
2. claude's Library/Keychains symlink was dead code, since claude's isolation lever only redirects CLAUDE_CONFIG_DIR, never HOME.

git diff -- .agents/skills/lib.sh matches this brief byte-for-byte (confirmed blob hashes: HEAD f2e23c1, working tree ea863c0, matching the diff's index line exactly).

"No other files changed" check

git status --short:

• M .agents/skills/lib.sh — the only tracked-file modification.
• ?? .agents/skills/multi-agent-mux-delegate-job/multi-agent-mux-delegate-job.<pid>_<n>.tmp, ?? .DS_Store — untracked, non-code artifacts (same benign job-runner scratch pattern observed in every prior review pass; .DS_Store is a macOS Finder metadata file, not a code change).

Confirmed: no files other than .agents/skills/lib.sh contain reviewable changes.

Verification performed

• bash -n .agents/skills/lib.sh — syntax OK.
• Read the full resulting claude and agy case-arms post-diff to confirm final state, not just the patch in isolation.

Findings

1. claude's Library/Keychains symlink block was fully removed — correct

The diff's claude arm hunk (@@ -1184,9 +1184,15 @@) diffs against the pre-b2e3ec97 baseline, which never had a Library/Keychains block for claude in committed history — that block only ever existed in the interim uncommitted state reviewed under b2e3ec97/fd3ba323. Reading the current file directly (lines 1185-1196) confirms the claude arm now ends after cache seeding with no Darwin/Keychains block at all. This is exactly the fix recommended in the fd3ba323 refined plan: claude's lever (isolation_lever() → claude_config_dir) never redirects HOME, so security/Keychain Services lookups by a spawned claude process always resolve against the real $HOME/Library/Keychains regardless of $root — the removed block was inert. Its removal is a correct dead-code cleanup, not a functional regression (it never had a documented behavior originally).

2. cp -a write-isolation conversion — correctly scoped and idempotent

Nine call sites were converted from ln -sfn to a guarded cp -a:

• claude: settings.json
• agy: .gemini/antigravity-ide, three Library/Preferences/$plist entries, Library/Application Support/{Antigravity, Antigravity IDE, com.google.GeminiMacOS}, and the four XDG config/data variants.

Each follows the pattern if [ ! -e/-d/-f "$root/<target>" ]; then cp -a "$HOME/<source>" "$root/<target>"; fi, which is correctly idempotent: a root that was already provisioned (e.g., across a session restart reusing the same isolation directory) will not be re-copied, preserving any local mutations (theme changes, TOS-ack state) made during a prior isolated session's lifetime rather than clobbering them with the host's current state on every restart. This matches the refined plan's explicit requirement (fd3ba323 §3.2: "대상이 $root에 이미 존재하지 않을 때만 복사"). seeded is still recorded unconditionally whenever the source exists, independent of whether the copy actually ran this time — correct, since the purpose of seeded is to report availability, not to log a fresh-copy event.

cp -a is valid on both BSD/macOS and GNU coreutils cp, recursively copies directories, and preserves symlinks-within (does not dereference), so nested references inside a copied tree (if any) remain intact and point at their original absolute targets — no unintended dereferencing side effects.

3. Risk-tiering matches the plan; remaining symlinked items are consistent with the "medium/low risk" bucket

Items still using ln -sfn after this diff — claude's session-env/sessions/cache/plugins/.credentials.json/.claude.json; agy's .gemini/* credential files, .gemini/antigravity, .gemini/config, Library/Keychains (agy only — correctly retained since agy's lever is home and Keychain access there is real), and Library/Group Containers — all correspond to the plan's "medium risk" (append-style history/cache, treated as parity with normal multi-terminal shared-machine behavior) or "low risk" (credential identifiers not rewritten by the running process itself) tiers. No high-risk single-source preference/theme file was left as a live symlink; no low/medium-risk item was unnecessarily converted to cp -a. The classification from the accepted plan was applied consistently.

4. Minor, non-blocking observation: Library/Application Support mkdir -p hoisted outside the per-target if blocks

The parent mkdir -p "$root/Library/Application Support" now runs unconditionally before the three Antigravity/Antigravity-IDE/GeminiMacOS checks, rather than only inside the first if block as before. This creates an empty Library/Application Support directory even when none of the three source directories exist on the host. Harmless (idempotent mkdir -p, no functional impact), and arguably cleaner since the same parent is now shared by three sibling if blocks instead of being created redundantly inside just one of them.

5. Known, plan-acknowledged open question (not a defect in this diff)

The fd3ba323 plan explicitly flagged as an open item whether "medium risk" append-style dirs (session-env, sessions, cache, conversation_summaries.db, etc.) should eventually also move to cp -a once product intent on cross-session history sharing is confirmed. This diff does not resolve that question — appropriately, since it wasn't in scope for the accepted plan's first implementation pass. Not counted against this diff.

No lint tool (shellcheck) is available in this environment; manual read-through found no quoting, unbound-variable, or subshell issues. All space-containing paths ("Library/Application Support", "Application Support/Antigravity IDE") remain correctly double-quoted throughout the new cp -a call sites.

Verdict

This diff is a faithful, correctly-scoped implementation of the accepted fd3ba323 refined plan: it removes the dead claude Keychain symlink, converts every identified high-risk single-source preference/theme/TOS file or directory to a guarded, idempotent one-time cp -a, and leaves append-style/low-mutation items on the existing symlink strategy per the plan's risk tiering. Syntax is valid, no other files were touched, and the one cosmetic observation (hoisted mkdir -p) does not affect behavior.

[VERDICT: PASS]