[jeremyfelder]

Problem

Reported: backgrounding a session in Claude Code (left arrow) and opening a new one fails with Not logged in.

Repro (Claude Code 2.1.202 and 2.1.310): zro claude → prompt works → left arrow to background → new session → not logged in.

Root cause

Two defects interact:

1. Gateway auth lost on daemon handoff. zro claude injects ANTHROPIC_BASE_URL/ANTHROPIC_AUTH_TOKEN only as process env on the launched claude. Backgrounded sessions (←, /background, --bg, agents view) run on daemon-spawned workers whose env is sanitized of ANTHROPIC_*. The worker resolves its gateway from per-session state that zro did not contribute to, so a daemon started outside zro (plain claude, desktop app, VS Code) leaves backgrounded sessions with no gateway → Not logged in.

2. Temp MCP config breaks respawns. --mcp-config pointed at a per-launch temp dir that zro deletes when the launched claude exits, but background sessions persist that path in their respawn flags. Any daemon respawn (idle retire→wake, restart, update) after the launch exits fails with exit 1 before init — MCP config file not found (verified on 2.1.202 and 2.1.310).

Fix

• Write mcp.json and a new settings.json (carrying env.ANTHROPIC_BASE_URL + env.ANTHROPIC_AUTH_TOKEN) to a stable ~/.cache/zro/claude/ dir (0600), passed via --settings. --settings and --mcp-config are both carried into Claude Code's respawn flags, so backgrounded and respawned sessions find their config regardless of which process started the daemon.
• zro logout removes the directory.
• Foreground path unchanged (env injection kept; --settings adds the same values).

Known limitation: concurrent launches with different keys (e.g. ZRO_API_KEY override) share one stable file — last launch wins for background respawns.

Verification

• Unit: new launch-plan test asserts stable paths, --settings arg, settings.json env block, and both files marked persistent; logout test asserts the directory is removed. pnpm run typecheck and pnpm test pass (98 passed).
• Live, Claude Code 2.1.202 and 2.1.310 (validated mechanism with stale-daemon scenario before implementing): background sessions authenticate via the settings file alone; with this build, zro claude -- --bg end-to-end completes (replied with exactly FIX-E2E-OK), respawn flags carry the stable paths, and foreground -p smoke test passes.
• Security: files are mode 0600 (same as ~/.config/zro/credentials.json), single fixed location, overwritten each launch, deleted on logout; --dry-run output already masks the token (existing redact()). No user settings files are touched — --settings is a session-scoped layer for zro launches only.

[zro-inference]

This PR keeps Claude Code background sessions authenticated with Zro by moving the generated MCP config and a new settings.json (carrying ANTHROPIC_BASE_URL/ANTHROPIC_AUTH_TOKEN) to a stable per-user cache path instead of the per-launch temp dir, marks both files persistent, and clears that directory on logout. The change is small and well-commented, and the accompanying tests cover the new launch paths, persistence flags, and logout cleanup. No blocking findings from this pass; note that all specialist analyses timed out on this run, so this approval reflects a direct read of the diff rather than deep correctness/security review.

JenClaude command reference

Reply with @MoonMathJen on this PR to trigger commands:

Command	Example	What it does
Re-review	@MoonMathJen rereview	Re-review after changes (full or scoped — see below)
Stop	@MoonMathJen stop	Cancel in-progress review
Stop + summarize	@MoonMathJen stop and summarize	Post partial findings so far
Focus specialty	@MoonMathJen only security	Review only the named specialty
Skip specialty	@MoonMathJen skip test-coverage	Review everything except the named specialty
Change model	@MoonMathJen pr-review-model: kimi-k2.7-coder	Run this review with a specific model
Add context	@MoonMathJen focus on auth edge cases	Free-text guidance passed to reviewers

Specialties: correctness, security, test-coverage, adversarial

Any text in the comment beyond a recognized command is passed to the reviewers as context. Use it to point them at areas that matter, explain what changed since the last review, or call out constraints (e.g. "skip generated files", "the auth flow is the riskiest part here"). Hard review rules still win over reviewer guidance.

---

JenClaude metrics: cost $0.000, time 44m 01s, tokens 55,612.