fix: MLflow env vars overwritten in settings.json due to race condition

[datasciencemonkey]

Bug

setup_mlflow.py merges MLflow env vars (MLFLOW_TRACKING_URI, MLFLOW_EXPERIMENT_NAME, etc.) into ~/.claude/settings.json, but they get silently wiped by two separate code paths:

1. _configure_all_cli_auth() overwrites settings.json from scratch

app.py:294-309 creates a fresh dict and writes it, nuking any existing content:

settings = {
    "env": {
        "ANTHROPIC_MODEL": ...,
        "ANTHROPIC_AUTH_TOKEN": token,
        ...
    }
}
with open(settings_path, "w") as f:
    json.dump(settings, f, indent=2)

This runs in configure_pat() before run_setup() kicks off, so it overwrites any MLflow vars from a prior setup.

2. setup_claude.py and setup_mlflow.py run in parallel

Both are in the parallel_steps list in run_setup(). If setup_claude.py writes settings.json, it can clobber what setup_mlflow.py just merged — race condition on the same file.

Fix

1. _configure_all_cli_auth() should read-merge-write instead of overwriting settings.json
2. setup_mlflow.py should run after setup_claude.py (sequentially), not in parallel

[datasciencemonkey]

Additional fixes on this branch

After rebasing onto main (opus-4-7 model names), added three more commits:

1. fix: add retry logic to npm CLI installs and fix test isolation

• setup_codex.py, setup_gemini.py, setup_opencode.py: npm installs now retry up to 3 times with 5s delay. On failure, full stderr/stdout is printed so we can diagnose install issues (discovered that dogfood environment blocks npm installs silently — npm returns rc=0 but no binary is created).
• tests/test_session_limit.py: Clear leaked sessions before the slot-freeing test to fix cross-test pollution.
• tests/conftest.py: Guard agent_plane import with try/except so tests run without the agent_plane package.

2. fix: remove duplicate skills copy in setup_gemini.py

• Skills already live in ~/.agents/skills/ (copied by setup_codex.py). Copying them again into ~/.gemini/skills/ caused Gemini CLI to log "Skill conflict detected" warnings for every skill on startup.
• Removed the duplicate copy and the unused shutil import.

Testing

• All 216 tests pass locally
• Deployed and verified on non-dogfood workspace (codex + gemini install and launch correctly)
• Dogfood environment has a separate npm registry restriction that needs investigation

[datasciencemonkey]

Merged to main (v0.18.1)

All fixes shipped:

Core fix

• settings.json race condition: setup_claude.py and app.py:_configure_all_cli_auth() now use read-merge-write pattern instead of overwriting the entire file. MLflow env vars set by setup_mlflow.py are no longer clobbered.

Additional fixes

• npm install retry logic (setup_codex.py, setup_gemini.py, setup_opencode.py): 3 retries with 5s delay, full stderr/stdout on failure. Discovered dogfood environment silently blocks npm installs (rc=0 but no binary created).
• Gemini skill conflicts (setup_gemini.py): Removed duplicate skills copy into ~/.gemini/skills/ — skills already live in ~/.agents/skills/ from Codex setup. Eliminates all "Skill conflict detected" warnings on Gemini startup.
• Test isolation (test_session_limit.py, test_session_detach.py): Clear leaked sessions from prior tests before running slot-freeing and list tests.
• Model names: Rebased onto main to pick up opus-4-7 model name updates.

Testing

• 216/216 tests passing locally
• Deployed and verified on non-dogfood workspace
• Dogfood npm issue is environment-specific (separate investigation needed)