fix: use 0o666 mode for ~/.claude.json to fix permissions

[Claude]

The GitHub Actions workflow was failing with EACCES: permission denied errors when trying to read ~/.claude.json after the agent container completed execution.

Root Cause

The file permission flow was incorrect:

1. docker-manager.ts creates ~/.claude.json on the host with mode 0o600 (owner read/write only)
2. Container entrypoint script runs as root and writes to the mounted file
3. Root's write changes file ownership, making it unreadable by the host user
4. Workflow's "Show final Claude Code config" step fails with permission denied

Changes

• Changed file creation mode from 0o600 to 0o666 in src/docker-manager.ts:565
• Added inline comment explaining the permission requirement

This allows both container root (for entrypoint writes) and host user (for workflow debugging) to access the file after container modifications.

// Use 0o666 mode to allow container root to write and host user to read
// The entrypoint script runs as root and modifies this file
fs.writeFileSync(claudeJsonPath, '{}', { mode: 0o666 });

[Copilot]

Pull request overview

This pull request attempts to fix permission issues with ~/.claude.json that were causing EACCES: permission denied errors in GitHub Actions workflows. The file is created by the host, modified by the container running as root, and then read back by the host user for debugging purposes.

Changes:

• Changed file creation mode from 0o600 to 0o666 for ~/.claude.json
• Added inline comments explaining the permission requirement

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The entrypoint script sets chmod 600 on this file after writing to it (containers/agent/entrypoint.sh:153 and :160). This will make the file owned by root with 600 permissions, which will prevent the host user from reading it.

To fix this, the entrypoint script should either:

1. Set chmod 644 instead of chmod 600 to allow read access
2. Or use chmod a+r to add read permissions for all users

The current approach of setting 0o666 here won't work because the entrypoint script's chmod command will override these permissions.

Suggested change

	// Use 0o666 mode to allow container root to write and host user to read
	// The entrypoint script runs as root and modifies this file
	fs.writeFileSync(claudeJsonPath, '{}', { mode: 0o666 });
	// The entrypoint script runs as root, writes to this file, and sets restrictive permissions
	// Use 0o600 here to align with the entrypoint's chmod behavior
	fs.writeFileSync(claudeJsonPath, '{}', { mode: 0o600 });