fix(codex-cloud): unbreak CI and close open review findings on #3587

Merged
BI
1mo ago
+74-23

User description

Summary

Follow-up commit for #3587, stacked on its branch (codex/cloud-policy-clarity). Merge this into that branch to turn #3587's CI green.

  • Root cause of the red CI: the new offline credential scrub blanks HEALTH_DEEP_PROBE_SECRET, but src/lib/env.ts required 16+ characters, so any route importing env threw at load. That failed both unit-coverage partitions (93 test files) and the Playwright Next build. A blank value is now treated as unset (same pattern as PROXY_AUTH); a non-blank value under 16 characters is still rejected, and an unset secret keeps the deep probe closed.
  • Shim installer: requires Node major 24 (22.x/20.x no longer pass the PATH fallback), and every PATH lookup skips $HOME/.local/bin so a shim cannot resolve to itself.
  • Profile relocation: drops the old separator so reruns stop adding blank lines.
  • Stale contracts: check-codex-cloud-setup.mjs and tests/codex-cloud-setup.test.ts still described the older shim/profile text; updated to match.

Verification (local, offline)

  • tests/codex-cloud-setup.test.ts + tests/codex-cloud-diagnose.test.ts: 50 passed
  • tests/env.test.ts (2 new cases), tests/work-sync.test.ts, tests/setup-status-route.test.ts: 39 passed
  • node scripts/check-codex-cloud-setup.mjs: PASS; tsc --noEmit and eslint on changed files: clean
  • generate-repo-awareness.mjs --check: snapshot already in step (the CodeRabbit snapshot comment is stale)
  • Not run locally: full unit suite, Playwright build (local Node is 22, CI uses 24). Hosted CI is the check for those.

RAG impact: no retrieval behaviour change — Cloud environment scripts and an env-schema parse rule only.

🤖 Generated with Claude Code

https://claude.ai/code/session_016NaMorGX7ibPrednN1p5qA

Generated by Claude Code

Summary by cubic

Treats a blank HEALTH_DEEP_PROBE_SECRET as unset, preventing offline test runs from failing when routes load the environment schema. Non-blank secrets still require at least 16 characters, and an unset secret keeps the deep probe closed.

  • Restricts the Codex Cloud shim installer to Node 24 and skips $HOME/.local/bin in PATH lookups to prevent shims from resolving to themselves.
  • Fixes the PATH cleanup loop hanging when a home path contains glob characters by comparing entries literally instead of via glob replacement.
  • Keeps shell profile updates idempotent and updates the setup contract checks and tests to match.

CodeAnt-AI Description

Fix Codex Cloud setup and blank health-probe secrets

What Changed

  • Blank health-probe secrets are treated as unset, so they no longer prevent the app from loading; short non-blank secrets are still rejected, and the probe stays closed when unset.
  • Codex Cloud command shims now require Node 24.15 or newer within the 24.x series and avoid resolving commands through their own directory.
  • Re-running Codex Cloud setup no longer adds extra blank lines to shell profiles.

Impact

✅ Fewer startup failures with blank probe secrets
✅ Codex Cloud commands avoid shim recursion
✅ Cleaner shell profiles after repeated setup

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.