[larsvikb]

What

Task 130, plan 27, with the operator's answer "warn". Marketplaces, plugins and their note were written into the config volume every tier-1 sandbox shares, so a sibling's boot rewrote them under running sandboxes, and one with no marketplaces wiped them. They are now each container's own, in /etc, beside the gateway pointer. Two commits; the first stands alone.

Refuse a marketplaces directory that overlaps the workspace. sc_marketplaces takes the canonical workspace and refuses a marketplaces directory that is it, lies inside it, or holds it: the workspace is read-write, so the plugin tree was writable through /workspace whatever the :ro said. A / workspace (only with ALLOW_UNSAFE_WORKSPACE=1) holds everything, so that override does not lift this. It is a new launch refusal, and it sees only this launch's workspace, not a sibling's.

Per-container launch settings.

• Rendered by the user, installed by root. The root phase runs tier-setup.sh --render-launch-settings through gosu, checks the output is exactly one JSON document matching LAUNCH_SHAPE (the two keys, non-empty objects, every plugin true, marketplace names wholly in [A-Za-z0-9._-]), and installs it root-owned as /etc/claude-code/launch-settings.json. Root opens no marketplace file. An empty render installs nothing; a failing or malformed one warns and launches without plugins, never aborting the boot.
• One managed note. The marketplace bullet joins the refs bullet in /etc/claude-code/CLAUDE.md, derived from the installed JSON. The user phase no longer writes plugin keys into $CONFIG_DIR/settings.json or appends to $CONFIG_DIR/CLAUDE.md; the "neither mounted nor known" advisory moved there.
• The wrapper prepends [--settings F] [--mcp-config G] --strict-mcp-config (appending fails after a subcommand). A caller's own --settings replaces the launch file, and the wrapper prints one stderr line saying the host's plugins are not loaded.
• Docs. DESIGN.md "Plugin marketplaces" (per-container, render-as-user, the scope consequence, what stays shared), NOTES.md (the measurements), README caveats, stale comments.

Measured on claude 2.1.310: --settings is command-line scope, so enabledPlugins: false in a project's or the user's settings, or plugin disable, no longer turns off a plugin the file enables (Claude Code prints "--settings keeps it on"). The operator approved this: a repo is not meant to override the host allowlist. The file wins per plugin, not wholesale: a plugin enabled in the shared user settings still loads beside it, so a sibling's in-session /plugin install reaches this sandbox's new sessions until the next boot. The note, DESIGN.md and README say both.

Checked

• In the container: make lint, make consistency and make test pass at both commits.
• MarketplaceWorkspaceOverlapTests runs sc_marketplaces on temp trees: equal, inside, holding, a symlink to the workspace and a / workspace are refused; a sibling and a name-prefix neighbour mount.
• New tests/test_launch_settings.py: the render on temp trees (layouts, nameless, broken, duplicate and out-of-alphabet manifests, unmounted marketplaces); LAUNCH_SHAPE; the note; the advisory; the root block run as written with gosu/install stubbed (nothing installed for {}, a failing render, or a malformed one including two documents and a name with a trailing newline); the wrapper over every file combination and six caller argvs. Placement tests pin root and user phase duties.
• 24 mutants of the root block, shape, render, note, advisory and wrapper, all killed; the review's 30 reran, with one survivor fixed and two equivalent.
• claude 2.1.310 in the container, scratch config and fixture marketplace (NOTES.md): loading with and without the file, never written back, last --settings wins, project/local/user false and plugin disable against it, the subcommands behind the prepends, two launch files over one config, a user-scope enable merging beside the file, the real wrapper in front of the real binary.
• On the maintainer's host, two concurrent sandboxes from this branch: A with the usual plugins runs its skill and carries the marketplace bullet; B with an empty marketplaces dir and SANDBOX_PLUGINS=nope@nowhere prints the advisory, has the short note and no skill; A's claude restarted after B's boot still has the skill (on main, B's boot rewrites the shared enabledPlugins). An old-image sandbox loses its appended note when a new-image one boots, until rebuilt.
• Not run: the interactive /plugin menu.

Generated with Claude Code