fix(container): harden task-tracker locking, quality-gate ordering, and CDP endpoint

- task-tracker.py: add fcntl-based file locking with retry (3 attempts,
  100ms) to prevent race conditions on concurrent TaskCreated/TaskCompleted
  hooks; add event type validation for early exit on unknown events
- quality-gate.py: move temp file deletion after block response output
  to ensure the block is sent even if cleanup fails; add session_id
  missing warning to stderr
- devcontainer.json: replace hardcoded 192.168.65.254 CDP endpoint with
  host.docker.internal for dynamic resolution across Docker environments
- install.sh: replace echo with heredoc for host Chrome usage examples
  so users can copy-paste directly without escaping issues

Author: AnExiledDev

container/.devcontainer/devcontainer.json

@@ -28,7 +28,7 @@
 		"CLAUDE_CONFIG_DIR": "/home/vscode/.claude",
 		"GH_CONFIG_DIR": "/workspaces/.gh",
 		"TMPDIR": "/workspaces/.tmp",
-		"HERMES_CDP_ENDPOINT": "http://192.168.65.254:9223",
+		"HERMES_CDP_ENDPOINT": "http://host.docker.internal:9223",
 		"TERM": "${localEnv:TERM:xterm-256color}",
 		"COLORTERM": "truecolor",
 		"CLAUDECODE": null

container/.devcontainer/features/agent-browser/install.sh

@@ -78,6 +78,8 @@ echo "  agent-browser close          # Close browser"
 echo ""
 echo "Host Chrome connection (if container browser insufficient):"
 echo "  # Windows: run .devcontainer\\scripts\\start-hermes-chrome.ps1 on the host"
-echo "  CDP_HOST=\$(getent ahostsv4 host.docker.internal | awk 'NR==1 {print \$1}')"
-echo "  curl http://\$CDP_HOST:9223/json/version"
-echo "  agent-browser connect \$CDP_HOST:9223"
+cat <<'USAGE'
+  CDP_HOST=$(getent ahostsv4 host.docker.internal | awk 'NR==1 {print $1}')
+  curl http://$CDP_HOST:9223/json/version
+  agent-browser connect $CDP_HOST:9223
+USAGE

container/.devcontainer/plugins/devs-marketplace/plugins/auto-code-quality/scripts/quality-gate.py

@@ -36,6 +36,7 @@ def main():
 
     session_id = input_data.get("session_id", "")
     if not session_id:
+        print("quality-gate: session_id missing from hook input", file=sys.stderr)
         sys.exit(0)
 
     # Skip if background tasks are still running
@@ -78,13 +79,6 @@ def main():
         sys.exit(0)
 
     # Block and tell Claude to run /cq
-    # Delete temp files so the NEXT stop (after /cq runs) exits clean
-    for prefix in ("claude-cq-edited", "claude-cq-lint"):
-        try:
-            os.unlink(f"/tmp/{prefix}-{session_id}")
-        except OSError:
-            pass
-
     file_list = "\n".join(f"  - {p}" for p in paths)
     json.dump(
         {
@@ -97,6 +91,14 @@ def main():
         },
         sys.stdout,
     )
+
+    # Delete temp files so the NEXT stop (after /cq runs) exits clean
+    for prefix in ("claude-cq-edited", "claude-cq-lint"):
+        try:
+            os.unlink(f"/tmp/{prefix}-{session_id}")
+        except OSError:
+            pass
+
     sys.exit(0)
 
 

container/.devcontainer/plugins/devs-marketplace/plugins/auto-code-quality/scripts/task-tracker.py

@@ -9,9 +9,11 @@
 Always exits 0.
 """
 
+import fcntl
 import json
 import os
 import sys
+import time
 
 # Hook gate — check ~/.claude/disabled-hooks.json
 _dh = os.path.join(os.path.expanduser("~"), ".claude", "disabled-hooks.json")
@@ -23,6 +25,62 @@
             sys.exit(0)
 
 
+_MAX_RETRIES = 3
+_RETRY_DELAY = 0.1  # 100ms
+
+
+def _locked_append(path: str, data: str) -> None:
+    """Append data to file under an exclusive lock."""
+    for attempt in range(_MAX_RETRIES):
+        try:
+            fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_APPEND, 0o644)
+            try:
+                fcntl.flock(fd, fcntl.LOCK_EX | fcntl.LOCK_NB)
+                os.write(fd, data.encode())
+                return
+            finally:
+                os.close(fd)
+        except BlockingIOError:
+            if attempt < _MAX_RETRIES - 1:
+                time.sleep(_RETRY_DELAY)
+        except OSError:
+            return
+
+
+def _locked_remove(path: str, task_id: str) -> None:
+    """Remove a task ID from the file under an exclusive lock."""
+    for attempt in range(_MAX_RETRIES):
+        try:
+            with open(path, "r+") as f:
+                fcntl.flock(f.fileno(), fcntl.LOCK_EX | fcntl.LOCK_NB)
+                lines = [line.strip() for line in f if line.strip()]
+
+                try:
+                    lines.remove(task_id)
+                except ValueError:
+                    return  # Task ID not found — may have been cleaned up
+
+                if lines:
+                    f.seek(0)
+                    f.truncate()
+                    f.write("\n".join(lines) + "\n")
+                else:
+                    # No more active tasks — remove file after releasing lock
+                    f.close()
+                    try:
+                        os.unlink(path)
+                    except OSError:
+                        pass
+                return
+        except FileNotFoundError:
+            return
+        except BlockingIOError:
+            if attempt < _MAX_RETRIES - 1:
+                time.sleep(_RETRY_DELAY)
+        except OSError:
+            return
+
+
 def main():
     try:
         input_data = json.load(sys.stdin)
@@ -34,43 +92,16 @@ def main():
         sys.exit(0)
 
     event = input_data.get("hook_event_name", "")
+    if event not in ("TaskCreated", "TaskCompleted"):
+        sys.exit(0)
+
     task_id = input_data.get("task_id", "") or input_data.get("id", "") or "unknown"
     tasks_file = f"/tmp/claude-active-tasks-{session_id}"
 
     if event == "TaskCreated":
-        try:
-            with open(tasks_file, "a") as f:
-                f.write(task_id + "\n")
-        except OSError:
-            pass
-
+        _locked_append(tasks_file, task_id + "\n")
     elif event == "TaskCompleted":
-        try:
-            with open(tasks_file) as f:
-                lines = [line.strip() for line in f if line.strip()]
-        except FileNotFoundError:
-            sys.exit(0)
-        except OSError:
-            sys.exit(0)
-
-        # Remove first occurrence of this task ID
-        try:
-            lines.remove(task_id)
-        except ValueError:
-            pass  # Task ID not found — may have been cleaned up
-
-        if lines:
-            try:
-                with open(tasks_file, "w") as f:
-                    f.write("\n".join(lines) + "\n")
-            except OSError:
-                pass
-        else:
-            # No more active tasks — clean up
-            try:
-                os.unlink(tasks_file)
-            except OSError:
-                pass
+        _locked_remove(tasks_file, task_id)
 
     sys.exit(0)