cli: auto-route mutating cmds to ctl when a daemon holds the lock; apt-in-userns

- When a lock-taking command (checkout/commit/exec/tag/gc/tournament) can't
  acquire the repo lock because a daemon/supervise is running, transparently
  route it through that session's control socket instead of failing with
  'another session is active'. Socket discovery: AGENTENV_SOCKET, then
  <root>/agentenv.sock, then the self-rollback <root>/work/current/.agentenv/
  control.sock. So 'agentenv checkout <id>' just works either way.
- examples/claude-code: bake APT::Sandbox::User "root" so apt-get works
  inside the rootless sandbox (userns forbids apt's setgroups privilege-drop
  to _apt → 'setgroups Operation not permitted').

Author: css521

examples/claude-code/Dockerfile

@@ -73,6 +73,13 @@ ENV AGENTENV_FORWARD=ANTHROPIC_*,CLAUDE_*,HTTP_PROXY,HTTPS_PROXY,NO_PROXY
 # caches (.cache/.npm/.local, apt lists) — so the snapshot DAG shows only the
 # changes Claude makes to your project. Set AGENTENV_IGNORE only to add more.
 
+# Make apt work INSIDE the rootless sandbox. In a user namespace, apt's
+# privilege-drop to the _apt user fails ("setgroups ... Operation not
+# permitted" — userns disallows setgroups after the uid map). Disabling apt's
+# sandbox user avoids the setgroups call. Baked into the image so it's seeded
+# into the managed rootfs; Claude Code can then run apt-get install inside.
+RUN printf 'APT::Sandbox::User "root";\n' > /etc/apt/apt.conf.d/99-agentenv-no-sandbox
+
 # Register the agentenv MCP server so Claude Code can roll back its OWN
 # environment via the agentenv__checkout tool. It talks to the control socket
 # INSIDE the sandbox (supervise --self-rollback puts it at /.agentenv/control.sock),

internal/cli/run.go

@@ -10,10 +10,44 @@ import (
 	"errors"
 	"fmt"
 	"os"
+	"path/filepath"
 
 	"github.com/css521/agentenv/internal/repo"
 )
 
+// ctlRoutable reports whether a mutating command has an out-of-band (ctl)
+// equivalent it can be transparently routed to when a daemon/supervise holds
+// the repo lock. Session-establishing commands (init/supervise/daemon/shell)
+// are excluded — they must own the lock themselves.
+func ctlRoutable(name string) bool {
+	switch name {
+	case "checkout", "commit", "exec", "tag", "gc", "tournament":
+		return true
+	}
+	return false
+}
+
+// liveControlSocket returns a control socket to route through when the lock is
+// busy, or "" if none is reachable. Checks, in order: AGENTENV_SOCKET, the
+// daemon socket (<root>/agentenv.sock), and the self-rollback in-sandbox socket
+// (<root>/work/current/.agentenv/control.sock).
+func liveControlSocket(root string) string {
+	candidates := []string{
+		os.Getenv("AGENTENV_SOCKET"),
+		filepath.Join(root, "agentenv.sock"),
+		filepath.Join(root, "work", "current", ".agentenv", "control.sock"),
+	}
+	for _, p := range candidates {
+		if p == "" {
+			continue
+		}
+		if fi, err := os.Stat(p); err == nil && fi.Mode()&os.ModeSocket != 0 {
+			return p
+		}
+	}
+	return ""
+}
+
 // Run parses os.Args[1:], dispatches, and returns the exit code main should
 // surface. It does NOT call os.Exit itself — that bypasses deferred Release()
 // of the repo lock (and any other defers a handler set up). main() is the only
@@ -80,6 +114,22 @@ func Run(version string) int {
 		var err error
 		lock, err = repo.AcquireLock(root)
 		if err != nil {
+			// The lock is held by a running daemon/supervise. Rather than fail
+			// with "another session is active", transparently route this command
+			// through that session's control socket — so `agentenv checkout <id>`
+			// just works whether or not a daemon is up. Only commands with an
+			// out-of-band equivalent are routed; the rest still report the error.
+			if sock := liveControlSocket(root); sock != "" && ctlRoutable(name) {
+				if e := cmdCtl(append([]string{"--socket", sock, name}, rest...)); e != nil {
+					var ee ExitError
+					if errors.As(e, &ee) {
+						return int(ee)
+					}
+					fmt.Fprintln(os.Stderr, "error:", e)
+					return 1
+				}
+				return 0
+			}
 			fmt.Fprintln(os.Stderr, "error:", err)
 			return 1
 		}