feat(cli): teleport dira into cloud agent runtimes

[azlekov]

Summary

Agents increasingly run in cloud runtimes — Claude Code on the web and Cursor cloud agents execute sessions in ephemeral VMs — and none of that work is captured today: dira init's hook configs embed a machine-specific absolute path, linking is interactive-only, and the VM's TLS-intercepting egress proxy defeats the binary's bundled-roots-only trust store (D-0011). This PR adds the repo side of capturing cloud agent work.

Teleport

• dira cloud init generates portable, repo-committed artifacts: .dira/hook.sh (run-time dira resolution, always exit 0) and .dira/bootstrap.sh (in a cloud VM: sha256-verified install of the pinned release from GitHub release assets, daemon start, runner-token device claim, then forwards its own SessionStart event; on a laptop: straight to the forward), plus portable hook commands merged into the project .claude/settings.json / .cursor/hooks.json — replacing machine-specific dira init entries rather than duplicating them. Idempotent/fixpoint, covered by a new e2e test.
• dira device link --runner-token (env DIRA_RUNNER_TOKEN): the headless claim variant — same endpoint and invariants as the code claim (server-assigned id, persist nothing until authoritative, nonce idempotency), no TTY anywhere on the path. The endpoint contract for dirahq-cloud is specified in .zavet/specs/cloud-runtime.md.
• Cursor cloud agents provision from .cursor/environment.json rather than a hook, via two non-hook bootstrap modes: --install-only (build phase, cached) and --provision-only (boot phase: install, start the daemon, claim a device, forward nothing — there is no hook payload on stdin and it must not fabricate one). Cursor exposes no session-start hook, and its hooks are skipped during the agent's early read-only turns, so provisioning cannot hang off one.
• dira_core::runtime::detect(): conservative runtime detection (CLAUDE_CODE_REMOTE, explicit DIRA_RUNTIME) used for device labels, diagnostics, and the 1.4 rollup stamp below — capture and accounting are byte-identical everywhere.

Contract 1.4: the runtime rides the wire

• SessionRollup.runtime + runtimeSessionRef (additive minor, 1.3.0 → 1.4.0): the cloud runtime the session ran in (claude-web, cursor-cloud, …) and the harness's own session reference, so the dashboard can badge cloud-agent work and deep-link transcripts. Both optional + omitted-when-absent; still metadata-only (a runtime name, never content).
• The daemon stamps both at flush time from runtime::detect() — a property of the running environment, not of stored events, and batch ids never derive from session rollups, so the post-assembly stamp cannot perturb chunk identity or dedup. Outside a cloud runtime the keys stay off the wire, byte-identical to 1.3.
• The signing vector now populates the new fields, so the cross-language fixture exercises them; schema + vector regenerated via just contract with the drift gates green. An older cloud strips unknown keys and gates on schema major only, so rollout order is free.

Transport, attribution, ephemerality

• DIRA_EXTRA_CA_CERTS (new decision DIRASH-0033, amending D-0011): every device→cloud reqwest client builds through dira_core::httpclient::builder(), which additively appends PEM anchors — never a store swap, never SSL_CERT_FILE, and a bad bundle degrades to the default client with a warning. The bootstrap takes the CA the runtime itself declares ($SSL_CERT_FILE → $NODE_EXTRA_CA_CERTS → ~/.ccr/ca-bundle.crt → system bundle).
• Configurable sync cadence: the 3s debounce / 90s backstop become clamped config knobs; cloud bootstraps set DIRA_SYNC_BACKSTOP_SECS=15 so an abruptly reclaimed VM loses at most ~15s of un-synced tail (batches were already idempotent with per-chunk cursors).
• DIRA_IDENTITY_EMAIL: attribution override for VMs whose git config user.email is the platform bot.

Observability

• dira doctor gains cloud.runtime, cloud.reachability (TLS failures name the extra-CA opt-in; other transport failures name the egress allowlist), and cloud.bootstrap.
• dira status --json / dira sessions --json: status --json carries today's rollup, so it still reports sessions that have already ended — the scriptable "what did dira capture" surface.

Measured, not assumed

Everything below was measured inside a live Claude Code cloud session:

• The egress proxy re-signs all TLS: with bundled roots only, every dira HTTPS call fails invalid peer certificate: UnknownIssuer, and succeeds once the runtime's CA is added. Nothing to configure — the CA is environment-provided.
• app.dirahq.sh is refused at the proxy with CONNECT tunnel failed, response 403, before TLS. That one does need the environment's Custom network access setting. The two failures are separate, and the docs now say which is which.
• Hooks fire in claude -p headless mode (SessionStart, UserPromptSubmit, Stop, SessionEnd) with no trust dialog, and CLAUDE_PROJECT_DIR is set. The committed hook command is nonetheless spelled ${CLAUDE_PROJECT_DIR:-.} so an unset variable can't resolve hooks to /.dira/… and fail them.

CI: a real agent session is captured

New .github/scripts/cloud-capture-smoke.sh + cloud-capture.yml. Every other test covers half the story — the unit tests pin what cloud init writes, cloud_init_e2e pins the artifacts, doctor --probe drives dira's own synthetic hook. None prove the part the design rests on: that a harness we do not control, wired only through committed config, fires hooks that land as counted events.

The job wires a throwaway repo, sets CLAUDE_CODE_REMOTE=true so the bootstrap takes the real cloud branch, runs Claude Code headless, and asserts on dira status --json that a session was captured and attributed to the fixture's canonical repo ref — which proves the writer's git enrichment ran, not merely that an event arrived.

Needs a CLAUDE_CODE_OAUTH_TOKEN repo secret (claude setup-token); without it — fork PRs, where GitHub exposes no secrets — it exits 0 with a SKIP so contributors never see a red check they cannot fix. Bounded by --max-budget-usd, path-scoped, GitHub-hosted runner.

Test plan

• just ci passes — run as its constituent commands (cargo fmt --check, cargo clippy --workspace --all-targets -- -D warnings, cargo test --workspace — all 32 suites green)
• sh -n clean on both generated scripts; --provision-only verified to start the daemon, pick the runtime-declared CA, and leave the store empty (no phantom event), and to be a clean no-op outside a cloud runtime
• The cloud-capture smoke test was run for real inside a Claude Code cloud VM: PASS — sessions=1 agent_seconds=6 project=github.com/dira-smoke/cloud-capture
• The full bootstrap → install → daemon → hook-capture loop exercised against the published v0.5.1 release assets (download, checksum verification, daemon up, events captured)
• /contract changed (schema 1.4, additive): just contract regenerated attestation.schema.json + the signing vector with the drift gates green; new serde test pins camelCase round-trip and byte-identical omission; the daemon stamp is covered by a dirad test that pins both branches (stamped inside a runtime, absent outside)
• The signed byte stream changed only via the regenerated fixture: the vector now populates runtime/runtimeSessionRef and was re-verified cross-language by the cloud's TS verifier (VALID — Rust signature verified by TypeScript over JCS(payload))
• If this changed install.sh / install.ps1: not applicable (shellcheck unavailable in this environment; the new scripts are sh -n / bash --posix -n clean)

Follow-ups

• The cloud counterpart (runner-token minting/claiming, fail-closed revocation, runtime badges, grouped runner devices) is implemented in dodi-smart/dirahq-cloud#150; end-to-end sync works once it deploys.
• dira init cursor wires sessionStart/sessionEnd, which are absent from Cursor's currently documented hook list — pre-existing behaviour in cli/sources, worth verifying separately.

Checklist

• Commits are signed off (git commit -s) per the DCO
• Commit messages follow Conventional Commits with a mandatory scope from cli, daemon, contract, ci, release, repo, deps (see CLAUDE.md)
• This PR targets develop (the integration trunk), not main
• Capture stays metadata-only — no prompt text, file contents, or diffs added to the store, an event, or an attestation (the runner token's value never enters diagnostics or facts; only its presence — and the 1.4 fields carry a runtime name and a session id, never content)

🤖 Generated with Claude Code

https://claude.ai/code/session_01S6tcfjfNEYvR926UrwVvfn

[github-actions]

Knowledge layer

Check	Result
Decision checks	passed
Guard trailers	passed

Spec currency is reported in the job summary and never fails a build, the same severity the local pre-commit hook uses.