mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 19:01:54 +00:00
kevinveenbirkenbachandClaude Opus 4.8
bcd32463a2
The second agent of requirement 032, pinned to the same isolating runtime as hermes. Unlike hermes it exposes a browser Control UI rather than a bearer API, so it takes the oauth2 proxy flavour with its own sso port; a proxy in front of a browser surface is correct where it would break OpenAI-compatible clients. Three deploy failures shaped this role. OpenClaw maps no environment variables onto config keys, so it restart-looped on 'Missing config' and then on 'non-loopback Control UI requires allowedOrigins'; both now come from a rendered openclaw.json mounted as a config. That render must run after sys-stk-full, because it notifies compose up and the handler would otherwise fire before the compose file exists. And the process runs as root: OpenClaw refuses a config file not owned by the running uid and writes cron state into its home, neither of which a non-root user can do against the platform's root-owned volume and config mount. gVisor is the isolation boundary here, not the in-guest uid. The administrator persona is blocked: the Control UI is a WebSocket SPA behind gateway device pairing with no DOM logout control for the shared helper. The SSO round-trip itself is covered by test-oidc-login.js, which drives the full unauthenticated to Keycloak to authenticated path. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
9 lines
243 B
JavaScript
9 lines
243 B
JavaScript
const { test } = require("@playwright/test");
|
|
const { runAdminFlow } = require("./personas");
|
|
|
|
exports.register = function () {
|
|
test("administrator: app → universal logout", async ({ page }) => {
|
|
await runAdminFlow(page, {});
|
|
});
|
|
};
|