fix(codex-cloud): harden shell profile sourcing, command shims, and offline env scrubbing

Merged
BI
1mo ago
+391-112

User description

Summary

Follow-up to #3581 completing the full audit and repair of the Codex Cloud and local/CI environment scripts:

  1. Prepend .clinical-kb-codex-cloud.sh to .bashrc, .profile, and .bash_profile (scripts/setup-codex-cloud.sh):
    • Ubuntu's default /root/.bashrc in codex-universal contains a non-interactive early-return guard (case $- in i) ;; *) return;; esac) near the top. Appending .clinical-kb-codex-cloud.sh at the bottom meant non-interactive shells that sourced .bashrc returned early before loading the Cloud profile. Prepending the block to the top ensures it runs before any non-interactive
      eturn.
  2. Automatic command-shim installation and non-
    vm fallback (scripts/setup-codex-cloud.sh, scripts/maintain-codex-cloud.sh, scripts/install-codex-cloud-command-shims.sh):
    • Both setup-codex-cloud.sh and maintain-codex-cloud.sh now invoke ash scripts/install-codex-cloud-command-shims.sh automatically before running validation checks, and install-codex-cloud-command-shims.sh falls back to the active non-shim
      ode binary directory on PATH if
      vm is absent or does not manage Node 24.
  3. Automatic Cloud profile loading in scripts/check-codex-cloud-setup.mjs:
    • Exports CODEX_CLOUD_PROFILE_LOADED=1 in ~/.clinical-kb-codex-cloud.sh and automatically sources ~/.clinical-kb-codex-cloud.sh when scripts/check-codex-cloud-setup.mjs is invoked directly in a Codex Cloud shell (CODEX_CLOUD=1, NODE_ENV !== 'test') that bypassed login/shim initialization (such as when /root/.nvm/versions/node/.../bin precedes $HOME/.local/bin in raw ash -c tool calls).
  4. Enforce the >=24.15.0 <25 Node floor in scripts/diagnose-codex-cloud.mjs:
    • Aligns diagnoseCodexCloud with scripts/check-runtime.ts and package.json ngines.node so older 24.x runtimes (e.g. 24.13.0) are reported as NODE_RUNTIME instead of healthy.
  5. Complete offline provider credential scrubbing (scripts/test-environment.mjs, scripts/check-codex-cloud-setup.mjs):
    • Expands providerEnvironmentKeys in scripts/test-environment.mjs with the full connector/token inventory (GH_TOKEN, GITHUB_TOKEN, CODEX_CLOUD_GITHUB_PAT, RAILWAY_API_TOKEN, RAILWAY_TOKEN, CROSS_TENANT_SERVICE_ROLE_KEY, HEALTH_DEEP_PROBE_SECRET, INDEXING_V3_AGENT_SECRET, and FIGMA_*) so offline Vitest/Playwright runs scrub all inherited tokens.
  6. Remove remaining xhighConfirmed field from RAG phase receipt schemas (docs/superpowers/rag-upgrade//phase-receipt., scripts/check-rag-phase-receipts.mjs).

Verification

ode scripts/check-codex-cloud-setup.mjs (PASS)

ode scripts/run-vitest.mjs run tests/codex-cloud-diagnose.test.ts tests/codex-cloud-setup.test.ts --reporter=dot (50 passed)

pm run docs:maintain &
ode scripts/check-format-changed.mjs (PASS)

Summary by cubic

Hardens the Codex Cloud shell profile, command shims, and offline credential scrubbing so Cloud tasks reliably load the runtime profile and inherit no provider tokens.

Bug Fixes

  • Prepends the Cloud profile block to the top of .bashrc, .profile, and .bash_profile, relocating any existing block and dropping the old separator, so reruns stay idempotent and Ubuntu's non-interactive return guard can't skip it.
  • Setup and maintenance now auto-install command shims; shims validate the detected Node version, fall back to the non-shim Node binary on PATH when nvm is absent or lacks Node 24, and require any npm/npx PATH fallback to match the repository's npm major from package.json engines.npm. Shims skip $HOME/.local/bin in PATH lookups so a shim never resolves to itself, and PATH cleanup uses literal comparison, fixing a hang on home paths with glob characters.
  • check-codex-cloud-setup.mjs auto-sources the profile in a Cloud shell (reporting re-exec failures) and exports CODEX_CLOUD_PROFILE_LOADED=1.
  • diagnose-codex-cloud.mjs now flags Node versions below 24.15.0 as NODE_RUNTIME instead of healthy.
  • Offline test scrubbing now covers the full connector/token inventory, including GH_TOKEN, Railway, Figma, and service secrets. A blank HEALTH_DEEP_PROBE_SECRET is treated as unset since the offline wrapper blanks it, while non-blank values under 16 characters still fail.

Refactors

  • Removes the xhighConfirmed field from RAG phase receipt schemas, templates, and the receipt checker.

Summary by CodeRabbit

  • New Features
    • Codex Cloud setup now installs command shims and loads the generated profile automatically in Cloud shells, including raw Bash commands.
    • Node.js detection supports installations found on PATH as well as nvm-managed versions.
  • Bug Fixes
    • Cloud diagnostics now clearly identify supported Node.js versions: 24.15.0 or later in the 24.x series.
    • Offline test environments now remove additional credential variables.
    • Blank health-check secrets are treated as unset rather than rejected.
  • Documentation
    • Updated Offline profile setup guidance and added a branch review record.

CodeAnt-AI Description

Load Codex Cloud settings reliably and isolate offline checks from host credentials

What Changed

  • Cloud setup loads its profile before shell early-return guards, installs command shims, and lets direct Cloud checks load the profile when needed.
  • Shims can use a supported Node 24 runtime found on PATH when nvm is unavailable; diagnostics now reject versions below 24.15.0.
  • Offline test runs scrub additional host credentials. A blank deep-probe secret is treated as unset, while non-blank secrets still require 16 characters.
  • RAG phase receipts no longer require an xhighConfirmed field.

Impact

✅ Reliable profile loading in non-interactive Cloud shells
✅ Cloud setup works with a supported Node runtime when nvm is unavailable
✅ Offline checks avoid inherited host credentials

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.