From db433e4d3419467dd5b5b147d2fada05e495f335 Mon Sep 17 00:00:00 2001
From: Ben Potter <me@bpmct.net>
Date: Mon, 18 May 2026 14:20:43 +0000
Subject: [PATCH] fix(coder-labs/claude-self-hosted-runner): infer lock status
 from active_sessions

The previous metadata script scraped
claude_code_self_hosted_runner_locked_account from /metrics. In
Anthropic BYOC build 2.1.97-byoc.9 the runner declares the HELP/TYPE
lines for that gauge but never emits a sample line, even when the
runner is actively serving sessions. The metadata item always
showed 'unlocked' regardless of state, which is wrong: a runner
with active_sessions > 0 has been locked to an Anthropic user for
its lifetime per Anthropic's spec.

Switch to inferring the lock status from /healthz's
active_sessions, and latch a sticky flag at $HOME/.claude/locked
on first observation of active_sessions > 0. Once locked, always
locked, even when the active count drops back to zero between
sessions of the same locked user.

Module tests still pass (6/6). Live verification will follow on the
bpmct/coder-dev-tunnel deployment.
---
 .../modules/claude-self-hosted-runner/main.tf  | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/registry/coder-labs/modules/claude-self-hosted-runner/main.tf b/registry/coder-labs/modules/claude-self-hosted-runner/main.tf
index e24db94b..33ac6aae 100644
--- a/registry/coder-labs/modules/claude-self-hosted-runner/main.tf
+++ b/registry/coder-labs/modules/claude-self-hosted-runner/main.tf
@@ -123,10 +123,20 @@ output "agent_metadata" {
       key          = "0_lock_status"
       interval     = 10
       timeout      = 5
-      script       = <<-EOT
-        val=$(curl -fsS http://127.0.0.1:8080/metrics 2>/dev/null \
-          | awk '/^claude_code_self_hosted_runner_locked_account[[:space:]]/ {print $2; exit}')
-        if [ "$val" = "1" ]; then
+      # The runner does not expose its locked state via /metrics or
+      # /healthz in the current BYOC build, so we infer it from
+      # active_sessions and latch a sticky flag on disk: once a
+      # session has landed, the runner is locked to that Anthropic
+      # user for its entire lifetime per Anthropic's spec, even when
+      # the active count drops back to zero between sessions.
+      script = <<-EOT
+        flag="$HOME/.claude/locked"
+        active=$(curl -fsS http://127.0.0.1:8080/healthz 2>/dev/null \
+          | jq -r '.active_sessions // 0')
+        if [ "$${active:-0}" -gt 0 ] && [ ! -f "$flag" ]; then
+          touch "$flag" 2>/dev/null || true
+        fi
+        if [ -f "$flag" ]; then
           printf 'locked'
         else
           printf 'unlocked'