From 5b089521219fa74440fe605985530fdcabcb0597 Mon Sep 17 00:00:00 2001
From: agentforce314 <273884145+agentforce314@users.noreply.github.com>
Date: Sun, 16 Aug 2026 02:32:15 -0700
Subject: [PATCH] fix(harbor): seed container config into CLAWCODEX_CONFIG_DIR,
 not ~/.clawcodex
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Every seeded setting — effort (subagent tier), advisor, vision, the
env-block API keys, fusion records — was silently inert in task
containers: the adapter writes the seed to ~/.clawcodex/config.json
under a stale claim that the global-config path 'deliberately does not
follow CLAWCODEX_CONFIG_DIR', but src/config.py has since unified the
config root on get_user_config_dir(), which honors the env var the
adapter itself sets to /installed-agent/clawcodex-config. The CLI read
an empty global config while the seed sat unread in the home dir.

Found by iteration: a --ak vision=openai:gpt-5.6-luna nano validation
run's system/init advertised six tools — vision_analyze never
registered because vision_is_configured() read the unseeded dir.
(--effort was unaffected on the main loop: it also rides a CLI flag,
so the completed TB comparisons stand.)

The seed now writes to the literal _CONTAINER_CONFIG_DIR (this exec's
env carries only the payload var, so $CLAWCODEX_CONFIG_DIR would
expand empty). _inject_subscription_credentials writes only
anthropic-oauth.json there — no clobber; the copy-back allowlist
already excludes the config-dir root, so key material still never
transits /logs.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 eval/harbor/clawcodex_agent.py | 24 +++++++++++++++++++-----
 1 file changed, 19 insertions(+), 5 deletions(-)

diff --git a/eval/harbor/clawcodex_agent.py b/eval/harbor/clawcodex_agent.py
index 166e78a0..40fe11df 100644
--- a/eval/harbor/clawcodex_agent.py
+++ b/eval/harbor/clawcodex_agent.py
@@ -805,9 +805,19 @@ async def _seed_container_settings(
 
         clawcodex's ``--effort`` flag governs the MAIN loop only; subagents
         (Agent tool) resolve effort from ``settings.effort``. Seeding the
-        container's global config (home-anchored ``~/.clawcodex/config.json``
-        — the global-config path deliberately does not follow
-        CLAWCODEX_CONFIG_DIR) makes the requested effort session-wide.
+        container's global config makes the requested effort session-wide.
+
+        The seed is written to ``$CLAWCODEX_CONFIG_DIR/config.json``
+        (``_CONTAINER_CONFIG_DIR``) — the SAME directory ``_build_env``
+        points the CLI at. It used to go to home-anchored
+        ``~/.clawcodex/config.json`` under a stale claim that the
+        global-config path "deliberately does not follow
+        CLAWCODEX_CONFIG_DIR": ``src/config.py`` has since unified the
+        config root on ``get_user_config_dir()`` (which honors the env
+        var), so every home-anchored seed — effort, advisor, vision,
+        env-block keys, fusion records — was silently inert in the
+        container. Found when a ``--ak vision=`` run's ``system/init``
+        advertised no vision tool.
 
         Also forwards the host's stored API keys (the global config's ``env``
         block) so tools that need one work inside the container -- WebSearch
@@ -871,12 +881,16 @@ async def _seed_container_settings(
         if not config:
             return
         payload = json.dumps(config)
+        # The literal container config dir, NOT "$CLAWCODEX_CONFIG_DIR": this
+        # exec's env carries only CLAWCODEX_SEED_CONFIG, so the variable would
+        # expand empty here. _inject_subscription_credentials writes only
+        # anthropic-oauth.json into the same dir — no clobber.
         await self.exec_as_agent(
             environment,
             command=(
-                'mkdir -p "$HOME/.clawcodex" && '
+                f'mkdir -p {_CONTAINER_CONFIG_DIR} && '
                 'printf \'%s\' "$CLAWCODEX_SEED_CONFIG" > '
-                '"$HOME/.clawcodex/config.json"'
+                f'{_CONTAINER_CONFIG_DIR}/config.json'
             ),
             env={"CLAWCODEX_SEED_CONFIG": payload},
         )