Repository navigation
fix(tooling): provision Claude OAuth EnvironmentFile on fleet+pet installs - #192
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3e94370034
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Boot pet CI under real systemd+linger, harden verify split-brain/hash checks, refuse symlink token files, source token on nohup pet path, and make the fleet live-auth probe require an agent-role reply with python3+claude present. Co-authored-by: Cursor <cursoragent@cursor.com>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0693a98929
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Pass pet and live-auth container scripts via docker exec -i heredocs so inner single quotes (pgrep, runuser/claude install) do not terminate the host bash -c string that Codex flagged on #192. Co-authored-by: Cursor <cursoragent@cursor.com>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 325904a33a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Atomic O_NOFOLLOW chmod/chown, nested content.role in live-auth probe, explicit Claude PATH for runuser, pet-path 0600 on existing tokens, and Python 3.8-safe verify annotations. Co-authored-by: Cursor <cursoragent@cursor.com>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d1e3960212
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…cmds (#192) Shell inode-stable chmod/chown fallback for pet hosts lacking python3, chmod 0600 before nohup token sourcing, and print the real runner unit in setup instructions instead of a <runner-unit> placeholder. Co-authored-by: Cursor <cursoragent@cursor.com>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5ce9e18e09
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
System-profile chmod/chown requires python3 O_NOFOLLOW (no path-based root fallback); parent dir chown is FD-based; verify reads fleet tokens and /proc environ via sudo -n and detects KillMode=process orphans by runner uid. Co-authored-by: Cursor <cursoragent@cursor.com>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 67d124fd18
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
) Use hapi runner start for nohup reloads, fail closed when system token parent cannot be chowned, reject non-regular pet tokens, remind operators to restart when a token already exists, and scope split-brain peers by HAPI_HOME (plus descendants) so interactive Claude on primary-soup is ignored. Co-authored-by: Cursor <cursoragent@cursor.com>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 744a714d12
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…ths (#192) Live-auth probe requires nested data.type=assistant, verify treats empty CLAUDE_CODE_OAUTH_TOKEN= as missing, and pet restart instructions shell-quote INSTALL_DIR / HAPI_WORKSPACE / token paths. Co-authored-by: Cursor <cursoragent@cursor.com>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 966b5efed9
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Addressed latest Codex round in 2318a26:
Unit tests updated + green. Please re-review. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2318a26a90
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Reserve auth probe exit 0 for runner_has; fresh installs with no token and no token-bearing peers are inconclusive (exit 5), not a false loaded PASS. Co-authored-by: Cursor <cursoragent@cursor.com>
|
Addressed Codex P2 in the follow-up commit: verify ambient-token probe now reserves exit 0 for |
|
@codex review Please review the current tip ( |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ae9d171c2d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Align shell and Python nonempty rules so CLAUDE_CODE_OAUTH_TOKEN=\r\n does not set expect_load, and exit 4 when the file cannot reproduce the runner's live token (empty assignment or mismatch). Co-authored-by: Cursor <cursoragent@cursor.com>
|
Addressed Codex P2: empty |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c4bd0da22f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…192) systemctl start is a no-op when Restart=always already respawned a pre-drop-in runner; always restart after writing EnvironmentFile. Treat whitespace-only CLAUDE_CODE_OAUTH_TOKEN= assignments as unconfigured in drop-in + embedded pet install paths. Co-authored-by: Cursor <cursoragent@cursor.com>
|
Addressed both Codex P2s:
|
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: dd815b61e9
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…#192) Companion install path now restarts hapi-runner after the OAuth drop-in (same Restart=always race as embedded pet). Verify compares tokens after systemd-compatible quote stripping so quoted assignments are not false stale mismatches. Co-authored-by: Cursor <cursoragent@cursor.com>
Codex: installer later EnvironmentFiles must be root-controlled, verifier file probe strips padded keys, user-pet --restart starts inactive units. Co-authored-by: Cursor <cursoragent@cursor.com>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 12240bb54b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Codex: empty EnvironmentFile= reset is unsafe without canon in the merged list; user-pet restart inspects UnsetEnvironment and later overrides. Co-authored-by: Cursor <cursoragent@cursor.com>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a33388fef8
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…links (#192) Codex: an inspect miss is not "no ambient token"; systemd follows later EnvironmentFile symlinks in user scope too, so skip-on-!-L was a hole. Co-authored-by: Cursor <cursoragent@cursor.com>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9e161b69f6
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
#192) Codex: missing ignore_errors=no files fail systemd start after stop; suffix-matching user token files skipped later overrides; toggle must run the merged-env gate; nohup must unset inherited OAuth before parse. Co-authored-by: Cursor <cursoragent@cursor.com>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2c497eb358
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Codex: estate-local preserved *.conf can be stricter than 0644; match the loaded-fragment uid/write-bit gate so restart is not blocked. Co-authored-by: Cursor <cursoragent@cursor.com>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 104d881011
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 129dee9ede
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…#192) Codex: interior quotes stay literal; curl pet validates token parents and replaces drop-ins without following symlinks; install_bytes coalesces logical lines; bash matches a single escaped backslash; verifier checks required EnvironmentFiles before canon-order skip. Co-authored-by: Cursor <cursoragent@cursor.com>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b5915766b7
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…e 0600 (#192) Unreadable later EnvironmentFiles can still override the token under systemd; inspect them or refuse. Walk custom user token homes to a trusted root. chmod 0600 retired .migrated.* archives. Co-authored-by: Cursor <cursoragent@cursor.com>
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a9232e7cf4
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Fail closed on missing optional later EnvironmentFile parents; validate user token parents when the leaf is absent; chmod 0600 leftover retire; reuse the normalized pet banner parser; always assert parents on nohup preflight; fix SIGPIPE in retire source check; Meta backoff only after ping delivery and keep undelivered fingerprints across thinking skips; align remat ping_cmd; restart hub+runner in pet token-rotate docs. Co-authored-by: Cursor <cursoragent@cursor.com>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e2f1d2ca3a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…192) The merged EnvironmentFiles gate (required shape/existence, later overrides) must run even when the canonical token is ineffective — otherwise a missing required file leaves OAUTH_RESTART_SAFE and the verifier can restart/kick watchdog into a failed start. Co-authored-by: Cursor <cursoragent@cursor.com>
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
…talls Installers write 42-claude-oauth-token.conf and migrate legacy tokens so runner ambient auth survives upgrades (Fixes #191). Verifier and soup-redeploy assert EnvironmentFile load; Meta ping backoff advances only after successful delivery. Co-authored-by: Cursor <cursoragent@cursor.com>
a5691eb to
9345869
Compare
Co-authored-by: Cursor <cursoragent@cursor.com>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0c83ff5fa1
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| curl ca-certificates procps sudo \ | ||
| && rm -rf /var/lib/apt/lists/* | ||
| EOF | ||
| docker build -f /tmp/hapi-pet-test.Dockerfile -t hapi-pet-test:ci /tmp |
There was a problem hiding this comment.
On the configured shared self-hosted runner, this can fail before any pet-install checks run because Docker must archive all of /tmp, including unreadable diagnostic sockets and unrelated files. The fleet job in this same workflow explicitly documents this failure mode at lines 198–200 and avoids it with an empty mktemp directory; apply the same isolated-context pattern here.
Useful? React with 👍 / 👎.
| ``` | ||
|
|
There was a problem hiding this comment.
With the usual umask 022, this redirection creates settings.json.tmp as mode 0644, and mv then replaces the deliberately mode-0600 settings.json with that world-readable file. The settings file can contain provider credentials and other secrets in addition to cliApiToken; they remain exposed until the hub successfully rewrites the file, or indefinitely if restart fails. Create the temporary file under umask 077 or explicitly install/chmod it to 0600 before replacement.
Useful? React with 👍 / 👎.
| if [[ -d "$HAPI_HOME" ]]; then | ||
| hapi_pet_assert_user_token_parents "${HAPI_HOME}/claude-setup-token.env" \ | ||
| || fail "user token parent $HAPI_HOME is not runner-owned / is group-or-other-writable — refusing before stop" | ||
| fi |
There was a problem hiding this comment.
On a fresh install where HAPI_HOME does not exist, this conditional skips the parent check, and the later mkdir -p "$HAPI_HOME/logs" creates it according to the caller's umask. With the common collaborative umask 0002, that produces a group-writable 0775 token parent: --with-systemd subsequently aborts after installing the binary, while the nohup path proceeds with a directory in which another group member can replace the OAuth file. Create HAPI_HOME as 0700 here, or otherwise validate and tighten it before stopping or installing anything.
Useful? React with 👍 / 👎.
| if [[ "$later_root" -eq 1 ]]; then | ||
| if [[ ! -f "$ef_path" ]]; then | ||
| echo "ERROR: later EnvironmentFile is not a regular file ($ef_path)" >&2 | ||
| return 0 | ||
| fi | ||
| local later_uid later_mode |
There was a problem hiding this comment.
When this gate is called with --user, the ownership and write-bit checks are skipped for every later EnvironmentFile. A preserved user drop-in can therefore reference a regular mode-0666 file that currently contains no OAuth assignment and pass validation; another local account can append CLAUDE_CODE_OAUTH_TOKEN= before any subsequent Restart=always launch, overriding the protected canonical token. Apply runner-ownership and non-group/other-writable checks to existing later files in user scope as well.
Useful? React with 👍 / 👎.
Co-authored-by: Cursor <cursoragent@cursor.com>
Promote from #192 exit reflection: short -R is ignored by the merge gate, so fork merges can target the wrong repo when gh defaults to upstream. Co-authored-by: Cursor <cursoragent@cursor.com>
1 participant
Summary
EnvironmentFiledrop-in (42-claude-oauth-token.conf) a first-class install step forfleet-binary,primary-soup, and pet/--with-systemdpaths vialib/hapi-claude-oauth-dropin.sh.verify-hapi-install.shto assert drop-in presence, unitEnvironmentFiles,/procload ofCLAUDE_CODE_OAUTH_TOKEN, and the runner-vs-child split-brain that fooled antevorta.soup-redeploy.ymlso fleet CI plants a probe token and asserts the runner loaded it; optional live Anthropic fresh-spawn whensecrets.CLAUDE_CODE_OAUTH_TOKENis set. Pet path asserts the drop-in exists under--with-systemd.options.token.Test plan
bash scripts/tooling/hapi-claude-oauth-dropin.test.shbash -non touched install/verify scriptstooling-testsjob on this PR (includes the new*.test.sh)CLAUDE_CODE_OAUTH_TOKENrepo secret andworkflow_dispatchsoup-redeploy for live spawn assertIssues
Fixes #191