Repository navigation
fix(openclaw): load standing-server credential in ACP adapter (#4615) - #4655
Merged
Merged
Conversation
The OpenClaw gateway launches bin/opencode-acp-adapter.mjs with no OPENCODE_SERVER_PASSWORD, and the adapter only read that env var, so requests to the password-protected standing opencode serve went out unauthenticated from the configured launch path. The adapter now resolves the password the way the rest of the fleet does (pm-stack dispatch OpenCodeClient, bin/openchamber-start.sh): env var first, then the JSON state file named by OPENCODE_AUTH_FILE (default ~/.local/state/opencode/service-prod.json, field password), read at runtime and cached per process. Nothing is baked into tracked config or the Nix store and the value is never logged: a missing file means no auth; a malformed or password-less file warns once on stderr (path and problem only) and requests go out unauthenticated so the serve 401 names the real problem. Tests: hermetic credential resolution (tests never touch the real env password or state file), gateway-launch-path coverage via a HOME fixture with a synthetic password, env-over-file precedence, and the malformed-file warning path. 8/8 node tests pass.
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 10 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. CodeRabbit Verify
|
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #4615 (queue task 6521).
Problem
The OpenClaw gateway launches
bin/opencode-acp-adapter.mjs(acpx config inhome/openclaw/default.nix) with noOPENCODE_SERVER_PASSWORD, and the adapter only read that env var — so requests from the configured launch path reached the password-protected standingopencode serveunauthenticated.Change
The adapter now resolves the standing server's password the way the rest of the fleet does (pm-stack dispatch's
OpenCodeClient,bin/openchamber-start.sh):OPENCODE_SERVER_PASSWORDenv, then the JSON state file named byOPENCODE_AUTH_FILE(default~/.local/state/opencode/service-prod.json, fieldpassword), read at runtime and cached per process (acpx launches a fresh adapter per gateway session).No change needed in
home/openclaw/default.nix: the configured command line is unchanged and now authenticates as launched.Tests
node --test bin/opencode-acp-adapter.test.mjs— 8/8 pass on the laptop:HOMEcontaining a synthetic-password state file and no env password sends the expectedAuthorizationheader, and the synthetic value never appears on stderr.OPENCODE_AUTH_FILEfixture authenticates; env password wins over the file.Synthetic fixture values only; no real credential was read, copied, or logged.
Open in [code]smith · Need help on this PR? Tag
@codesmith-botwith what you need.