fix(minimal): don't scaffold over an existing config on non-interactive activate - #758

…it prompt

When a session shell exits, the daemon shows an `async_dialog::Select`
prompt (Detach / Delete) and blocks on the SSH channel for the answer. A
non-interactive attach — a scripted client, or one whose connection
dropped — has no one to answer, so the session host wedges on the prompt
forever (the reader never sees a keypress, nor an EOF, since a forced-pty
client delivers stdin close as an in-band Ctrl-D rather than a channel
EOF).

Bound the prompt with a short grace period, defaulting to the safe Detach
(identical to the existing At(0)/Cancelled arms) on timeout. This mirrors
the non-tty guard in #758: no interactive prompt may block a
non-interactive caller.

A gate on "no PTY requested" cannot serve here: `shell_request` only ever
grants a session shell with a PTY (it rejects a shell otherwise), so at
the exit prompt a PTY is always present — the pty-absence signal is
unreachable. A bounded wait is the reachable equivalent, and it also
covers a dropped or idle interactive client.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

… min add)

The shared session e2e only proved the lifecycle (activate -> ls ->
destroy -> stop); it never forked a session sandbox, so it could not
catch a break in the real in-sandbox user path. Deepen it, on the native
lane (DM2), to attach an INTERACTIVE PTY shell — which forks a real
hakoniwa sandbox — and prove the in-sandbox `min` helper:

  - self-seed a throwaway project (mktemp -d) with the repo's own pinned
    [upstream] and a light shell stack, and activate THAT, not the repo
    root (a non-interactive activate over the repo root scaffolds over
    .minimal/minimal.toml; fixed crate-side in #758).
  - pipe an interactive `min attach <sid>` a command stream that records a
    non-baseline tool (tar) as absent, `min add`s it into the session,
    then runs it. Its version banner round-tripping proves `min add`
    reached the daemon over the /run/minenv_sock relay and hardlinked the
    package into the live rootfs. On `exit` the session-exit prompt
    auto-detaches this non-interactive client (the minimald fix in this
    same PR), so the attach returns exit 0.

The proof is gated off the VM lanes (E2E_VM): there the sandbox forks
inside the guest, whose compose/cache and bridge-driven attach this
harness cannot validate; those stay proven in Rust. VM lanes run the
lifecycle proof only — no faked coverage. The existing structure
(set -uo pipefail, mnl(), fail()/teardown(), ::group::/::error::,
millisecond timing) is preserved; shellcheck is clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…it prompt

When a session shell exits, the daemon shows an `async_dialog::Select`
prompt (Detach / Delete) and blocks on the SSH channel for the answer. A
non-interactive attach — a scripted client, or one whose connection
dropped — has no one to answer, so the session host wedges on the prompt
forever (the reader never sees a keypress, nor an EOF, since a forced-pty
client delivers stdin close as an in-band Ctrl-D rather than a channel
EOF).

Bound the prompt with a short grace period, defaulting to the safe Detach
(identical to the existing At(0)/Cancelled arms) on timeout. This mirrors
the non-tty guard in #758: no interactive prompt may block a
non-interactive caller.

A gate on "no PTY requested" cannot serve here: `shell_request` only ever
grants a session shell with a PTY (it rejects a shell otherwise), so at
the exit prompt a PTY is always present — the pty-absence signal is
unreachable. A bounded wait is the reachable equivalent, and it also
covers a dropped or idle interactive client.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

… min add)

The shared session e2e only proved the lifecycle (activate -> ls ->
destroy -> stop); it never forked a session sandbox, so it could not
catch a break in the real in-sandbox user path. Deepen it, on EVERY lane
(native DM2, KVM DM3, macOS DM1), to attach an INTERACTIVE PTY shell —
which forks a real hakoniwa sandbox (on a VM lane, inside the guest, over
the vsock bridge) — and prove the in-sandbox `min` helper:

  - guarantee the activate target carries a host-side `minimal.toml`: the
    native lane self-seeds a throwaway `mktemp -d` (repo's pinned
    [upstream] + a light shell stack), never the repo root; when the
    caller sets E2E_PROJECT_DIR (VM lanes pass /tmp) we seed one there if
    missing. Since #758 a non-interactive `min activate` over a
    config-less dir bails, so this is the harness-side complement.
  - pipe an interactive `min attach <sid>` a command stream that records a
    non-baseline tool (tar) as absent, `min add`s it into the session,
    then runs it. Its version banner round-tripping proves `min add`
    reached the daemon over the /run/minenv_sock relay and hardlinked the
    package into the live rootfs. On `exit` the session-exit prompt
    auto-detaches this non-interactive client (the minimald fix in this
    same PR), so the attach returns exit 0.

The proof is un-gated: the `min` CLI abstracts where the daemon lives, so
the identical attach+add+run runs on all three lanes (the script's design
premise), and the VM lanes exercise the more valuable bridge-exec path.
Structure preserved (set -uo pipefail, mnl(), fail()/teardown(),
::group::/::error::, millisecond timing); shellcheck clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

When a session shell exits, the daemon shows a Detach/Delete prompt and
blocks on the SSH channel for the answer. A non-interactive attach — a
scripted or piped client — has no one to answer, so the session host
wedges on the prompt forever (a forced-pty client delivers stdin close as
an in-band Ctrl-D, never a channel EOF the reader could detect).

Have the `min` client report whether its own context is a terminal (both
stdin and stdout a tty) via a MINIMAL_INTERACTIVE env var, independent of
the forced `-tt`. The session host consults it at the exit prompt: an
interactive client is prompted as before; a non-interactive one skips the
unanswerable prompt and deletes the session on exit, so an ephemeral
attach cleans up after itself instead of orphaning a session. Mirrors the
non-tty bail in #758: no interactive prompt may block a non-interactive
caller.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

The shared session e2e only proved the lifecycle; it never forked a
session sandbox, so it could not catch a break in the real in-sandbox user
path. Deepen it, on every lane (native, KVM, macOS), to attach a PTY shell
— which forks a real hakoniwa sandbox (on a VM lane, inside the guest over
the vsock bridge) — and prove the in-sandbox `min` helper: record a
non-baseline tool (tar) as absent, `min add` it into the session, then run
it; its version banner round-tripping proves `min add` reached the daemon
over the /run/minenv_sock relay and hardlinked the package into the live
rootfs.

The piped attach is non-interactive, so on `exit` the daemon deletes the
session (the minimald change in this branch); the script verifies the
delete-on-exit rather than issuing a separate `min destroy`. A host-side
minimal.toml is seeded so the client pre-flight neither prompts nor bails
(#758); every seed is removed on teardown.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

When a session shell exits, the daemon shows a Detach/Delete prompt and
blocks on the SSH channel for the answer. A non-interactive attach — a
scripted or piped client — has no one to answer, so the session host
wedges on the prompt forever (a forced-pty client delivers stdin close as
an in-band Ctrl-D, never a channel EOF the reader could detect).

Have the `min` client report whether its own context is a terminal (both
stdin and stdout a tty) via a MINIMAL_INTERACTIVE env var, independent of
the forced `-tt`. The session host consults it at the exit prompt: an
interactive client is prompted as before; a non-interactive one skips the
unanswerable prompt and deletes the session on exit, so an ephemeral
attach cleans up after itself instead of orphaning a session. Mirrors the
non-tty bail in #758: no interactive prompt may block a non-interactive
caller.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

The shared session e2e only proved the lifecycle; it never forked a
session sandbox, so it could not catch a break in the real in-sandbox user
path. Deepen it, on every lane (native, KVM, macOS), to attach a PTY shell
— which forks a real hakoniwa sandbox (on a VM lane, inside the guest over
the vsock bridge) — and prove the in-sandbox `min` helper: record a
non-baseline tool (tar) as absent, `min add` it into the session, then run
it; its version banner round-tripping proves `min add` reached the daemon
over the /run/minenv_sock relay and hardlinked the package into the live
rootfs.

The absence marker is built at runtime (printf "TOOL_%s_BEFORE") so the
PTY echo of the command stream cannot satisfy the assertion — the literal
appears only as executed output. The piped attach is non-interactive, so
on `exit` the daemon deletes the session (the minimald change in this
branch); the script verifies the delete-on-exit rather than issuing a
separate `min destroy`. A host-side minimal.toml is seeded so the client
pre-flight neither prompts nor bails (#758); every seed is removed on
teardown.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

When a session shell exits, the daemon shows a Detach/Delete prompt and
blocks on the SSH channel for the answer. A non-interactive attach — a
scripted or piped client — has no one to answer, so the session host
wedges on the prompt forever (a forced-pty client delivers stdin close as
an in-band Ctrl-D, never a channel EOF the reader could detect).

Have the `min` client report whether its own context is a terminal (both
stdin and stdout a tty) via a MINIMAL_INTERACTIVE env var, independent of
the forced `-tt`. The session host consults it at the exit prompt: an
interactive client is prompted as before; a non-interactive one skips the
unanswerable prompt and deletes the session on exit, so an ephemeral
attach cleans up after itself instead of orphaning a session. Mirrors the
non-tty bail in #758: no interactive prompt may block a non-interactive
caller.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

The shared session e2e only proved the lifecycle; it never forked a
session sandbox, so it could not catch a break in the real in-sandbox user
path. Deepen it, on every lane (native, KVM, macOS), to attach a PTY shell
— which forks a real hakoniwa sandbox (on a VM lane, inside the guest over
the vsock bridge) — and prove the in-sandbox `min` helper: record a
genuinely-absent tool (jq — the shell stack composes base + curl, and jq
is pulled in by neither) as absent, `min add` it into the session, then
run it; its version banner round-tripping proves `min add` reached the
daemon over the /run/minenv_sock relay and hardlinked the package into the
live rootfs.

The absence marker is built at runtime (printf "TOOL_%s_BEFORE") so the
PTY echo of the command stream cannot satisfy the assertion — the literal
appears only as executed output. The piped attach is non-interactive, so
on `exit` the daemon deletes the session (the minimald change in this
branch); the script verifies the delete-on-exit rather than issuing a
separate `min destroy`. A host-side minimal.toml is seeded so the client
pre-flight neither prompts nor bails (#758); every seed is removed on
teardown.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

When a session shell exits, the daemon shows a Detach/Delete prompt and
blocks on the SSH channel for the answer. A non-interactive attach — a
scripted or piped client — has no one to answer, so the session host
wedges on the prompt forever (a forced-pty client delivers stdin close as
an in-band Ctrl-D, never a channel EOF the reader could detect).

Have the `min` client report whether its own context is a terminal (both
stdin and stdout a tty) via a MINIMAL_INTERACTIVE env var, independent of
the forced `-tt`. The session host consults it at the exit prompt: an
interactive client is prompted as before; a non-interactive one skips the
unanswerable prompt and deletes the session on exit, so an ephemeral
attach cleans up after itself instead of orphaning a session. Mirrors the
non-tty bail in #758: no interactive prompt may block a non-interactive
caller.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

The shared session e2e only proved the lifecycle; it never forked a
session sandbox, so it could not catch a break in the real in-sandbox user
path. Deepen it, on every lane (native, KVM, macOS), to attach a PTY shell
— which forks a real hakoniwa sandbox (on a VM lane, inside the guest over
the vsock bridge) — and prove the in-sandbox `min` helper: record a
genuinely-absent tool (jq — the shell stack composes base + curl, and jq
is pulled in by neither) as absent, `min add` it into the session, then
run it; its version banner round-tripping proves `min add` reached the
daemon over the /run/minenv_sock relay and hardlinked the package into the
live rootfs.

The absence marker is built at runtime (printf "TOOL_%s_BEFORE") so the
PTY echo of the command stream cannot satisfy the assertion — the literal
appears only as executed output. The piped attach is non-interactive, so
on `exit` the daemon deletes the session (the minimald change in this
branch); the script verifies the delete-on-exit rather than issuing a
separate `min destroy`. A host-side minimal.toml is seeded so the client
pre-flight neither prompts nor bails (#758); every seed is removed on
teardown.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

The shared session e2e only proved the lifecycle; it never forked a
session sandbox, so it could not catch a break in the real in-sandbox user
path. Deepen it, on every lane (native, KVM, macOS), to attach a PTY shell
— which forks a real hakoniwa sandbox (on a VM lane, inside the guest over
the vsock bridge) — and prove the in-sandbox `min` helper: record a
genuinely-absent tool (jq — the shell stack composes base + curl, and jq
is pulled in by neither) as absent, `min add` it into the session, then
run it; its version banner round-tripping proves `min add` reached the
daemon over the /run/minenv_sock relay and hardlinked the package into the
live rootfs.

The absence marker is built at runtime (printf "TOOL_%s_BEFORE") so the
PTY echo of the command stream cannot satisfy the assertion — the literal
appears only as executed output. The piped attach is non-interactive, so
on `exit` the daemon deletes the session (the minimald change in this
branch); the script verifies the delete-on-exit rather than issuing a
separate `min destroy`. A host-side minimal.toml is seeded so the client
pre-flight neither prompts nor bails (#758); every seed is removed on
teardown.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

The shared session e2e only proved the lifecycle; it never forked a
session sandbox. Deepen it, on every lane, to attach an interactive shell
— which forks a real hakoniwa sandbox (on a VM lane, inside the guest over
the vsock bridge) — and prove the in-sandbox `min` helper: record a
genuinely-absent tool (jq — the shell stack composes base + curl, and jq
is pulled in by neither) as absent, `min add` it, then run it; its version
banner round-tripping proves `min add` reached the daemon over the
/run/minenv_sock relay and hardlinked the package into the live rootfs.

A session is interactive by design, so the proof drives it like a real
user through a REAL pty (scripts/e2e-attach-pty.py): pump the command
stream, then answer the session-exit Detach/Delete prompt with keystrokes
(Down + Enter => Delete). A pipe is not a tty and cannot answer that
prompt. Selecting Delete tears the session down, so it must be delisted.
Output is matched with a bash glob, not `printf | grep -q`, so `min add`'s
progress-bar flood cannot SIGPIPE a pipefail false-negative. A host-side
minimal.toml is seeded (uploaded to the session since #748) so the client
pre-flight neither prompts nor bails (#758); every seed is removed on
teardown.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

The shared session e2e only proved the lifecycle; it never forked a
session sandbox. Deepen it, on every lane, to attach an interactive shell
— which forks a real hakoniwa sandbox (on a VM lane, inside the guest over
the vsock bridge) — and prove the in-sandbox `min` helper: record a
genuinely-absent tool (jq — the shell stack composes base + curl, and jq
is pulled in by neither) as absent, `min add` it, then run it; its version
banner round-tripping proves `min add` reached the daemon over the
/run/minenv_sock relay and hardlinked the package into the live rootfs.

A session is interactive by design, so the proof drives it like a real
user through a REAL pty (scripts/e2e-attach-pty.py): pump the command
stream, then answer the session-exit Detach/Delete prompt with keystrokes
(Down + Enter => Delete). A pipe is not a tty and cannot answer that
prompt. Selecting Delete tears the session down, so it must be delisted.
Output is matched with a bash glob, not `printf | grep -q`, so `min add`'s
progress-bar flood cannot SIGPIPE a pipefail false-negative. A host-side
minimal.toml is seeded (uploaded to the session since #748) so the client
pre-flight neither prompts nor bails (#758); every seed is removed on
teardown.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

The shared session e2e only proved the lifecycle; it never forked a
session sandbox. Deepen it, on every lane, to attach an interactive shell
— which forks a real hakoniwa sandbox (on a VM lane, inside the guest over
the vsock bridge) — and prove the in-sandbox `min` helper: record a
genuinely-absent tool (jq — the shell stack composes base + curl, and jq
is pulled in by neither) as absent, `min add` it, then run it; its version
banner round-tripping proves `min add` reached the daemon over the
/run/minenv_sock relay and hardlinked the package into the live rootfs.

A session is interactive by design, so the proof drives it like a real
user through a REAL pty (scripts/e2e-attach-pty.py): pump the command
stream, then answer the session-exit Detach/Delete prompt with keystrokes
(Down + Enter => Delete). A pipe is not a tty and cannot answer that
prompt. Selecting Delete tears the session down, so it must be delisted.
Output is matched with a bash glob, not `printf | grep -q`, so `min add`'s
progress-bar flood cannot SIGPIPE a pipefail false-negative. A host-side
minimal.toml is seeded (uploaded to the session since #748) so the client
pre-flight neither prompts nor bails (#758); every seed is removed on
teardown.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

… every lane (#760)

* fix(checkouts): report exit status on git command failure

A failed git command surfaced only its stderr. When git is killed by a
signal (e.g. OOM mid-fetch) stderr holds only whatever it wrote before
dying — which can be a misleadingly benign line such as a "templates not
found" warning, masking that the process was killed rather than failing
cleanly.

Include the rendered ExitStatus (exit code or signal) in GitCommandFailed
and its mctx wrapper, so a signal kill is distinguishable from a
git-reported error.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* test: exercise the session sandbox via interactive attach

The shared session e2e only proved the lifecycle; it never forked a
session sandbox. Deepen it, on every lane, to attach an interactive shell
— which forks a real hakoniwa sandbox (on a VM lane, inside the guest over
the vsock bridge) — and prove the in-sandbox `min` helper: record a
genuinely-absent tool (jq — the shell stack composes base + curl, and jq
is pulled in by neither) as absent, `min add` it, then run it; its version
banner round-tripping proves `min add` reached the daemon over the
/run/minenv_sock relay and hardlinked the package into the live rootfs.

A session is interactive by design, so the proof drives it like a real
user through a REAL pty (scripts/e2e-attach-pty.py): pump the command
stream, then answer the session-exit Detach/Delete prompt with keystrokes
(Down + Enter => Delete). A pipe is not a tty and cannot answer that
prompt. Selecting Delete tears the session down, so it must be delisted.
Output is matched with a bash glob, not `printf | grep -q`, so `min add`'s
progress-bar flood cannot SIGPIPE a pipefail false-negative. A host-side
minimal.toml is seeded (uploaded to the session since #748) so the client
pre-flight neither prompts nor bails (#758); every seed is removed on
teardown.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* ci: provision gvproxy for the KVM/macOS session-e2e lanes

The KVM and macOS session-e2e lanes boot a microVM whose guest daemon
clones the upstream `pkgs` repo during session mint. That clone needs the
guest's egress — NAT + DNS — which minvmd provides by spawning gvproxy as
the per-host-VM switch. Neither lane provisioned the gvproxy binary, and
its resolution is best-effort (never errors), so minvmd booted the VM
switchless: the guest's overlay had no other end and every egress —
including the clone — died with "Could not resolve host: github.com".

Fetch the pinned gvproxy (scripts/fetch-gvproxy.sh, already used by the
native minimald-root-integration job) and point minvmd at it via
MINVMD_GVPROXY_BIN on each lane's session-e2e step. The macOS lane's
fetch auto-selects the gvproxy-darwin asset.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>