Checking the Coop box on the Docker runtime

Protecting secrets
  ✓ .env is hidden
  ✓ .envrc is hidden
  ✓ Terraform variable files are hidden
  ✓ Private keys are hidden
  ✓ Custom .coopignore paths are hidden
  ✓ Secret directories are empty
  ✓ Links cannot reveal hidden secrets
  ✓ Hidden secret files cannot be written
  ✓ Environment templates stay readable
  ✓ Source files stay readable
  ✓ The test secret cannot be read

Host access and privileges
  ✓ The host Coop CLI is absent
  ✓ The host Docker socket is absent
  ✓ The box runs as a non-root user
  ✓ Linux capabilities are removed
  ✓ The process limit is enforced (4096)

Offline access
  ✓ Offline mode leaves only the loopback interface

Task access
  ✓ The task channel exposes only its 8 task tools
  ✓ Calls outside the task tools are refused
  ✓ Changes to a task held by another process are refused
  ✓ The assigned task can be updated

Credentials and settings
  ✓ Claude's native home is available
  ✓ Host account grants stay outside Claude's home
  ✓ Codex's native home is hidden from Claude
  ✓ Gemini's native home is hidden from Claude
  ✓ Grok's native home is hidden from Claude
  ✓ Claude's saved login takes priority over its environment key
  ✓ Codex's environment key is hidden from Claude
  ✓ Gemini's environment key is hidden from Claude
  ✓ The box can write its settings directory

Fork handoff
  ✓ .env is absent from the clone
  ✓ .envrc is absent from the clone
  ✓ Secret directories are absent from the clone
  ✓ Private keys are absent from the clone
  ✓ Tracked source files are present in the clone
  ✓ The test secret is absent from the clone
  ✓ The clone's origin is a local path

Box cleanup
  ⚠ Coop cannot tell which boxes this computer started, so it removes none of them

        /Users/me/.local/state/coop/host-id.json holds no host id this Coop can read.

  Once no Coop runs on this computer, delete /Users/me/.local/state/coop/host-id.json. Coop then makes a new id.

Running boxes
  ⚠ Could not identify the supervisor for 1 box
    42c96f112acd

  Check that the box is no longer needed before removing it manually.

✓ All 37 checks passed
