fabi/Sylpheed
1
0
Fork 0
Code Issues 9 Pull Requests Actions Packages Projects Releases Wiki Activity

containers: an expired token could never be replaced

Browse Source 
Credentials were seeded only when the container's copy was MISSING. So when a
session expired, the file still existed, the copy was skipped, and restarting
changed nothing -- the one recovery path a human has, re-logging in on the host,
could not reach the containers at all.

Now re-seeds whenever the host's copy is newer. Newer-wins rather than
always-copy, because a container refreshes its own token mid-run and that copy
may legitimately be the fresher of the two.

Found when both sessions expired: host credentials at 16:30, containers holding
14:20 and 14:24.
This commit is contained in:
MechaCat02
2026-08-29 16:31:53 +02:00
parent 002df51173
commit 0cceaaf4a9
3 changed files with 36 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
docker/decoder/entrypoint.sh
View File

@@ -133,13 +133,23 @@ mkdir -p /exchange/files 2>/dev/null || true
# Seeded rather than shared because credentials live in .credentials.json and a
# token refresh must be able to write. Copying once means each agent refreshes
# its own token and neither can corrupt the host's.
if [ -d "$HOME/.claude.seed" ] && [ ! -s "$HOME/.claude/.credentials.json" ]; then
# Re-seed whenever the HOST's credentials are newer than ours, not only when
# ours are missing. The missing-only guard meant an expired token could never be
# replaced: the file existed, so the copy was skipped, and restarting the
# container changed nothing. A human re-logging in on the host is exactly the
# recovery path, and it has to reach here.
#
# Newer-wins rather than always-copy, because the container refreshes its own
# token during a run and that copy may legitimately be the fresher one.
if [ -d "$HOME/.claude.seed" ] && \
{ [ ! -s "$HOME/.claude/.credentials.json" ] || \
[ "$HOME/.claude.seed/.credentials.json" -nt "$HOME/.claude/.credentials.json" ]; }; then
mkdir -p "$HOME/.claude"
cp -a "$HOME/.claude.seed/.credentials.json" "$HOME/.claude/" 2>/dev/null || true
for f in settings.json CLAUDE.md; do
[ -e "$HOME/.claude.seed/$f" ] && cp -a "$HOME/.claude.seed/$f" "$HOME/.claude/" 2>/dev/null || true
done
echo "[entrypoint] seeded ~/.claude from the host (credentials only)"
echo "[entrypoint] refreshed ~/.claude credentials from the host"
fi
# Seed ~/.claude.json from the host's read-only copy, then stamp onboarding as

14
docker/port/entrypoint.sh
View File

@@ -30,13 +30,23 @@ echo "[entrypoint] display $DISPLAY ready ($SCREEN_GEOMETRY)"
# Seeded rather than shared because credentials live in .credentials.json and a
# token refresh must be able to write. Copying once means each agent refreshes
# its own token and neither can corrupt the host's.
if [ -d "$HOME/.claude.seed" ] && [ ! -s "$HOME/.claude/.credentials.json" ]; then
# Re-seed whenever the HOST's credentials are newer than ours, not only when
# ours are missing. The missing-only guard meant an expired token could never be
# replaced: the file existed, so the copy was skipped, and restarting the
# container changed nothing. A human re-logging in on the host is exactly the
# recovery path, and it has to reach here.
#
# Newer-wins rather than always-copy, because the container refreshes its own
# token during a run and that copy may legitimately be the fresher one.
if [ -d "$HOME/.claude.seed" ] && \
{ [ ! -s "$HOME/.claude/.credentials.json" ] || \
[ "$HOME/.claude.seed/.credentials.json" -nt "$HOME/.claude/.credentials.json" ]; }; then
mkdir -p "$HOME/.claude"
cp -a "$HOME/.claude.seed/.credentials.json" "$HOME/.claude/" 2>/dev/null || true
for f in settings.json CLAUDE.md; do
[ -e "$HOME/.claude.seed/$f" ] && cp -a "$HOME/.claude.seed/$f" "$HOME/.claude/" 2>/dev/null || true
done
echo "[entrypoint] seeded ~/.claude from the host (credentials only)"
echo "[entrypoint] refreshed ~/.claude credentials from the host"
fi
# Seed ~/.claude.json from the host's read-only copy, then stamp onboarding as