Stop carrying fix/claude-securestorage-config-dir: superseded by nolabs-ai/nono#2085

[jeremy]

Stops carrying fix/claude-securestorage-config-dir (730021fa). Upstream fixed the same bug, and the branch no longer merges, so the next rebuild would stop on it. Its line moves to the recipe's "Not carried" list. The branch itself is kept, as with fix/credential-capture-owned-children.

Why

Upstream nolabs-ai/nono#2085 (c14abc87), merged 2026-10-12, fixes nolabs-ai/nono#1950 the same way the topic does. It exports an empty CLAUDE_SECURESTORAGE_CONFIG_DIR alongside CLAUDE_CONFIG_DIR unless the host already set one: the topic's var_os(..).is_some() guard and upstream's var_os(..).is_none() select the same cases. Upstream also does two things the topic didn't:

• The preflight check now applies the same rule to its Keychain service name, so it looks up the item Claude Code actually reads.
• A test pins that push_set_vars passes the empty value through to the child as KEY=.

On upstream main at f116b86f, the topic conflicts in crates/nono-cli/src/sandbox_prepare.rs. Rebased and resolved to upstream's version, it leaves no diff. Only one hunk conflicts textually, though. A mechanical resolution would have kept a second helper beside upstream's claude_config_dir_env, duplicated the tests, and said the same thing twice in docs/cli/clients/claude.mdx, all of which merges cleanly.

Checked

• Today's recipe fails. .github/integration/rebuild (no --push) on integration gives: topic branch fix/claude-securestorage-config-dir (730021fa4f02) does not merge onto upstream main f116b86fa59a: conflicts in crates/nono-cli/src/sandbox_prepare.rs.
• This branch's recipe builds. .github/integration/rebuild --layer integration-drop-claude-securestorage merges the remaining five topics onto upstream main 19a09490 without conflicts, giving 296b880b. It prints no "changes nothing" notes.
• The merged tree is clean. cargo clippy --workspace --all-targets --all-features -- -D warnings -D clippy::unwrap_used is clean on 296b880b. Upstream's claude_config_dir_env_* and push_set_vars_* tests pass there; the claude_keychain_service_name_* tests are macOS-only.
• With Carry feat/dry-run-json in integration #5's topic too. On f116b86f, the same drop on top of Carry feat/dry-run-json in integration #5's layer builds all six topics including feat/dry-run-json, giving 07f1758b. There, clippy and cargo fmt --check are clean. cargo test -p nono-cli passes 2232 tests; three that need short socket paths or credential capture fail the same way on plain upstream on this host, and one /tmp race passes when run alone.

After merging

• The rebuild runs on this. Merging pushes to integration, which starts the rebuild and then a build.
• Carry feat/dry-run-json in integration #5 touches the same lines. It appends a line next to the one removed here. Whichever merges second needs that one line rebased.

[jeremy]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-12T19:30:16.537820Z	11c42b7	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Copilot]

🟢 Approved

The recipe change correctly prevents the conflicting, upstreamed topic from blocking future integration rebuilds.

0 open findings

What changed in this PR

Removes a superseded, conflicting topic branch from the integration rebuild recipe.

Changes:

• Moves fix/claude-securestorage-config-dir to “Not carried.”
• Records that upstream PR nolabs-ai#2085 supersedes it.

[!TIP]
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

File	Description
.github/​integration/​topics	Removes the superseded topic from the merge recipe and documents why.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Swish!

Reviewed commit: 11c42b7ef3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".