fix(cloud): wait for repo sync before native agent tools
A native full-access Claude or Codex tool could run while a Cloud repository was still being seeded. Synchronous PreToolUse hooks now wait for that existing sync before letting the tool run. Claude's native ACP adapter registers the same callback. Incomplete or timed-out syncs return a provider denial; wrapper failures exit 2 instead of silently allowing the tool.
Leo's request: “Block edits until the repo sync finishes: the agent’s file-write tools wait on the sync barrier instead of racing it.” This extends #34491 to native tool hooks, including installed and fallback commands. Hooks remain on by default; reverting this PR restores the previous hook behavior.
The gate is a readiness wait: its lease ends before the native tool executes, so a later concurrent reseed can still race a native tool. The ACP filesystem write path retains its lease through the write. Tool cwd and explicit file/directory targets are checked; arbitrary shell command destinations are not parsed.
Performance
| Metric | Before | After | Delta | Harness |
|---|---|---|---|---|
| Native pre-tool edits retained during an existing seed | 0/100 | 100/100 | +100 percentage points | cmux-git test native_pre_tool_retention_measurement, same 100-iteration schedule |
This deterministic retention measurement is separate from the end-to-end first-keystroke Cloud readiness p50/p95 probes.
Validation
Pending fleet receipt: sync barrier and native-hook integration tests; hooks installer, trust and shell-wrapper suite; native Claude callback tests; hook binary compile check.
The pre-tool wait stops on readiness, failed sync, or timeout. Hook configuration allows 90 seconds around the 30-second readiness budget and lock acquisition; no background loop survives the hook.
Changelog
Cloud agent tools wait for an in-progress repository sync before editing.
🤖 Generated with Codex
Agent session: agent session