mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 4.8
bcd32463a2
The second agent of requirement 032, pinned to the same isolating runtime as hermes. Unlike hermes it exposes a browser Control UI rather than a bearer API, so it takes the oauth2 proxy flavour with its own sso port; a proxy in front of a browser surface is correct where it would break OpenAI-compatible clients. Three deploy failures shaped this role. OpenClaw maps no environment variables onto config keys, so it restart-looped on 'Missing config' and then on 'non-loopback Control UI requires allowedOrigins'; both now come from a rendered openclaw.json mounted as a config. That render must run after sys-stk-full, because it notifies compose up and the handler would otherwise fire before the compose file exists. And the process runs as root: OpenClaw refuses a config file not owned by the running uid and writes cron state into its home, neither of which a non-root user can do against the platform's root-owned volume and config mount. gVisor is the isolation boundary here, not the in-guest uid. The administrator persona is blocked: the Control UI is a WebSocket SPA behind gateway device pairing with no DOM logout control for the shared helper. The SSO round-trip itself is covered by test-oidc-login.js, which drives the full unauthenticated to Keycloak to authenticated path. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
13 lines
481 B
JavaScript
13 lines
481 B
JavaScript
const { decodeDotenvQuotedValue, normalizeBaseUrl } = require("./personas");
|
|
|
|
const env = {
|
|
baseUrl: normalizeBaseUrl(process.env.OPENCLAW_BASE_URL || ""),
|
|
canonicalDomain: decodeDotenvQuotedValue(process.env.CANONICAL_DOMAIN || ""),
|
|
gatewayToken: decodeDotenvQuotedValue(process.env.OPENCLAW_GATEWAY_TOKEN || ""),
|
|
ssoEnabled: String(process.env.SSO_SERVICE_ENABLED || "").toLowerCase() === "true",
|
|
};
|
|
|
|
async function beforeEach() {}
|
|
|
|
module.exports = { env, beforeEach };
|