mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 4.8
bcd32463a2
The second agent of requirement 032, pinned to the same isolating runtime as hermes. Unlike hermes it exposes a browser Control UI rather than a bearer API, so it takes the oauth2 proxy flavour with its own sso port; a proxy in front of a browser surface is correct where it would break OpenAI-compatible clients. Three deploy failures shaped this role. OpenClaw maps no environment variables onto config keys, so it restart-looped on 'Missing config' and then on 'non-loopback Control UI requires allowedOrigins'; both now come from a rendered openclaw.json mounted as a config. That render must run after sys-stk-full, because it notifies compose up and the handler would otherwise fire before the compose file exists. And the process runs as root: OpenClaw refuses a config file not owned by the running uid and writes cron state into its home, neither of which a non-root user can do against the platform's root-owned volume and config mount. gVisor is the isolation boundary here, not the in-guest uid. The administrator persona is blocked: the Control UI is a WebSocket SPA behind gateway device pairing with no DOM logout control for the shared helper. The SSO round-trip itself is covered by test-oidc-login.js, which drives the full unauthenticated to Keycloak to authenticated path. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
4 lines
45 B
YAML
4 lines
45 B
YAML
---
|
|
status_codes:
|
|
default: [200, 301, 302]
|