umputun / ralphex
84%
master: 84%

LAST BUILD BRANCH: dependabot/github_actions/actions/setup-go-7
DEFAULT BRANCH: master
Repo Added
Files 55
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

LAST BUILD ON BRANCH fix-oauth-token-persistence
branch: fix-oauth-token-persistence
CHANGE BRANCH
x

coverage: 83.727%. First build
29715424248

Pull #412

github

umputun 
fix: harden OAuth credential bind mounts and keep older wrappers working

Follow-up fixes to the credential write-through mounts, from a multi-agent review.

Mount emission (scripts/ralphex-dk.sh):
- use --mount type=bind rather than -v for the two credential files. A missing -v source makes
  docker create a DIRECTORY at the target, corrupting the credential path; --mount fails the
  container start instead, so the is_file() guard can no longer be raced.
- CSV-quote the source: --mount parses as CSV, so a comma in the resolved path (reachable via
  $HOME or CLAUDE_CONFIG_DIR) split the field and docker rejected the spec. -v tolerated it.
- no SELinux option on these specs: docker's --mount has no relabel option at all (podman's
  relabel= has no docker equivalent; z/Z are -v only). The parent ~/.claude and ~/.codex are
  -v mounted with :z and docker's z relabel walks the source tree, so the bound inodes are
  already labeled.

Container init (scripts/internal/init-docker.sh):
- keep copying the credential files when the wrapper supplies no bind mount. The init script
  ships in the image but the wrapper updates through a separate channel (--update-script vs
  docker pull), so "new image + old wrapper" is a supported combination that otherwise left
  the container with no credentials at all. seed_claude_home/seed_codex_home probe the target
  before copying — docker establishes mounts before the entrypoint, and the fallback creates
  the file itself, so the probe cannot be deferred until after the copy.
- gate the chown on the same probe: a bind-mounted file must not be chowned (it would mutate
  the host file's metadata), but a fallback copy lands root:app 0600 and needs the full
  chown -R to be writable by app.
- anchor the chown exclusions with -path; ! -name matched at any depth.

Tests and docs:
- cover both wrapper generations in init-docker_test.sh and wire the harness into CI — it had
  no references anywhere and never ran. Ownership is not ... (continued)
Pull Request #412: fix: persist OAuth token refreshes from container to host

7795 of 9310 relevant lines covered (83.73%)

226.79 hits per line

Relevant lines Covered
9310 RELEVANT LINES 7795 COVERED LINES
226.79 HITS PER LINE
Source Files on fix-oauth-token-persistence

Recent builds

Builds Branch Commit Type Ran Committer Via Coverage
29715424248 fix-oauth-token-persistence fix: harden OAuth credential bind mounts and keep older wrappers working Follow-up fixes to the credential write-through mounts, from a multi-agent review. Mount emission (scripts/ralphex-dk.sh): - use --mount type=bind rather than -v for the tw... Pull #412 umputun github
83.73
29566449686 fix-oauth-token-persistence fix: harden OAuth credential bind mounts and keep older wrappers working Follow-up fixes to the credential write-through mounts, from a multi-agent review. Mount emission (scripts/ralphex-dk.sh): - use --mount type=bind rather than -v for the tw... Pull #412 umputun github
83.78
29566174422 fix-oauth-token-persistence fix: harden OAuth credential bind mounts and keep older wrappers working Follow-up fixes to the credential write-through mounts, from a multi-agent review. Mount emission (scripts/ralphex-dk.sh): - use --mount type=bind rather than -v for the tw... push umputun github
83.78
29561552992 fix-oauth-token-persistence fix: persist OAuth token refreshes from container to host Add rw file bind-mounts for ~/.codex/auth.json and ~/.claude/.credentials.json so token refreshes inside the container write through to host files. Previously, init-docker.sh copied them f... push umputun github
83.74
See All Builds (754)