Merge pull request #441 from skulidropek/pr-440

[codex] fix Claude auth probe and state sync locking

Author: skulidropek

.changeset/fix-claude-auth-login-probe.md

@@ -0,0 +1,19 @@
+---
+"@prover-coder-ai/docker-git": patch
+---
+
+Fix `docker-git auth claude login` failing after a successful OAuth login.
+
+After `claude setup-token` created and persisted the OAuth token, the login
+command ran a verification probe (`claude -p ping`) and treated any non-zero
+exit as a hard failure, exiting with code 1 even though the token was already
+saved. A transient probe failure (network hiccup, rate limit, or token
+propagation delay) would therefore discard an otherwise successful login.
+
+The probe failure is now reported as a warning instead of an error, mirroring
+`docker-git auth claude status`. The token is kept, and the user is advised to
+re-check connectivity later with `docker-git auth claude status`.
+
+Controller startup now also rejects `DOCKER_GIT_CONTROLLER_GPU=all` when
+`docker-compose.gpu.yml` exists as a directory instead of a regular file,
+matching the extra compose overlay invariant before invoking Docker Compose.

.github/actions/setup/action.yml

@@ -57,4 +57,32 @@ runs:
       run: npm install -g node-gyp
     - name: Install dependencies
       shell: bash
-      run: bun install --frozen-lockfile
+      run: |
+        run_bun_install() {
+          local timeout_seconds=$((20 * 60))
+          bun install --frozen-lockfile &
+          local install_pid="$!"
+          (
+            sleep "$timeout_seconds"
+            echo "bun install exceeded 20 minutes; terminating" >&2
+            kill "$install_pid" 2>/dev/null || true
+          ) &
+          local timeout_pid="$!"
+          local status=0
+          wait "$install_pid" || status="$?"
+          kill "$timeout_pid" 2>/dev/null || true
+          wait "$timeout_pid" 2>/dev/null || true
+          return "$status"
+        }
+
+        for attempt in 1 2 3; do
+          if run_bun_install; then
+            exit 0
+          fi
+          if [[ "$attempt" == "3" ]]; then
+            echo "bun install failed after retries" >&2
+            exit 1
+          fi
+          echo "bun install attempt ${attempt} failed; retrying..." >&2
+          sleep $((attempt * 2))
+        done

.github/workflows/check.yml

@@ -249,6 +249,27 @@ jobs:
       - name: Login context notice
         run: bash scripts/e2e/login-context.sh
 
+  e2e-auth-claude-login:
+    name: E2E (Claude auth login)
+    runs-on: ubuntu-latest
+    timeout-minutes: 40
+    env:
+      DOCKER_GIT_CONTROLLER_BUILD_SKILLER: "0"
+      DOCKER_GIT_E2E_REUSE_WORKSPACE_INSTALL: "1"
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+        with:
+          persist-credentials: false
+          submodules: true
+      - name: Install dependencies
+        uses: ./.github/actions/setup
+      - name: Free Docker disk
+        uses: ./.github/actions/free-docker-disk
+      - name: Docker info
+        run: docker version && docker compose version
+      - name: Claude auth login warning path
+        run: bash scripts/e2e/auth-claude-login.sh
+
   e2e-runtime-volumes-ssh:
     name: E2E (Runtime volumes + SSH)
     runs-on: ubuntu-latest

bun.lock

@@ -7,6 +7,7 @@
   "workspaces": [
     "packages/api",
     "packages/app",
+    "packages/auth-oauth",
     "packages/container",
     "packages/docker-git-session-sync",
     "packages/lib",
@@ -15,13 +16,13 @@
   ],
   "scripts": {
     "setup:pre-commit-hook": "bun scripts/setup-pre-commit-hook.js",
-    "build": "bun run --filter @prover-coder-ai/docker-git-session-sync build && bun run --filter @prover-coder-ai/docker-git-terminal build && bun run --filter @prover-coder-ai/docker-git build",
+    "build": "bun run --filter @prover-coder-ai/docker-git-auth-oauth build && bun run --filter @prover-coder-ai/docker-git-session-sync build && bun run --filter @prover-coder-ai/docker-git-terminal build && bun run --filter @prover-coder-ai/docker-git build",
     "api:build": "bun run --filter @effect-template/api build",
     "api:start": "bun run --filter @effect-template/api start",
     "api:dev": "bun run --filter @effect-template/api dev",
     "api:test": "bun run --filter @effect-template/api test",
     "api:typecheck": "bun run --filter @effect-template/api typecheck",
-    "check": "bun run --filter @prover-coder-ai/docker-git-session-sync check && bun run --filter @prover-coder-ai/docker-git-terminal check && bun run --filter @prover-coder-ai/docker-git-openapi check && bun run --filter @prover-coder-ai/docker-git check && bun run --filter @effect-template/lib typecheck",
+    "check": "bun run --filter @prover-coder-ai/docker-git-auth-oauth check && bun run --filter @prover-coder-ai/docker-git-session-sync check && bun run --filter @prover-coder-ai/docker-git-terminal check && bun run --filter @prover-coder-ai/docker-git-openapi check && bun run --filter @prover-coder-ai/docker-git check && bun run --filter @effect-template/lib typecheck",
     "check:dist-deps-prune": "bun node_modules/@prover-coder-ai/dist-deps-prune/dist/main.js scan --package ./packages/app/package.json --prune-dev true --silent",
     "changeset": "changeset",
     "changeset-publish": "bun -e \"if (!process.env.NPM_TOKEN) { console.log('Skipping publish: NPM_TOKEN is not set'); process.exit(0); }\" && changeset publish",
@@ -52,8 +53,8 @@
     "lint:effect": "bun run --filter @prover-coder-ai/docker-git-session-sync lint:effect && bun run --filter @prover-coder-ai/docker-git-terminal lint:effect && bun run --filter @prover-coder-ai/docker-git lint:effect && bun run --filter @prover-coder-ai/docker-git-container lint:effect && bun run --filter @effect-template/lib lint:effect && bun run --filter @effect-template/api lint:effect",
     "effect:skill:init": "git submodule update --init --checkout third_party/effect-ts-skills",
     "effect:skill:check": "bun run effect:skill:init && bash .codex/skills/effect-ts-guide/scripts/run-effect-ts-check.sh packages/app/src/web/api-create-project.ts packages/app/src/web/api-database.ts packages/app/src/web/api-http.ts packages/app/src/web/api-prompts.ts packages/app/src/web/api-skills.ts packages/app/src/web/api-tasks.ts packages/openapi/src --profile strict",
-    "test": "bun run --filter @prover-coder-ai/docker-git-session-sync test && bun run --filter @prover-coder-ai/docker-git-terminal test && bun run --filter @prover-coder-ai/docker-git test && bun run --filter @effect-template/lib test",
-    "typecheck": "bun run --filter @prover-coder-ai/docker-git-session-sync typecheck && bun run --filter @prover-coder-ai/docker-git-terminal typecheck && bun run --filter @prover-coder-ai/docker-git-openapi typecheck && bun run --filter @prover-coder-ai/docker-git typecheck && bun run --filter @effect-template/lib typecheck",
+    "test": "bun run --filter @prover-coder-ai/docker-git-auth-oauth test && bun run --filter @prover-coder-ai/docker-git-session-sync test && bun run --filter @prover-coder-ai/docker-git-terminal test && bun run --filter @prover-coder-ai/docker-git test && bun run --filter @effect-template/lib test",
+    "typecheck": "bun run --filter @prover-coder-ai/docker-git-auth-oauth typecheck && bun run --filter @prover-coder-ai/docker-git-session-sync typecheck && bun run --filter @prover-coder-ai/docker-git-terminal typecheck && bun run --filter @prover-coder-ai/docker-git-openapi typecheck && bun run --filter @prover-coder-ai/docker-git typecheck && bun run --filter @effect-template/lib typecheck",
     "start": "bun run --cwd packages/app build:docker-git && bun ./packages/app/dist/src/docker-git/main.js"
   },
   "devDependencies": {

package.json

@@ -76,9 +76,10 @@ RUN set -eu; \
 FROM controller-base AS workspace-deps
 
 COPY package.json bun.lock bunfig.toml tsconfig.base.json tsconfig.json ./
-RUN mkdir -p packages/api packages/app packages/container packages/docker-git-session-sync packages/lib packages/openapi packages/terminal
+RUN mkdir -p packages/api packages/app packages/auth-oauth packages/container packages/docker-git-session-sync packages/lib packages/openapi packages/terminal
 COPY packages/api/package.json ./packages/api/package.json
 COPY packages/app/package.json ./packages/app/package.json
+COPY packages/auth-oauth/package.json ./packages/auth-oauth/package.json
 COPY packages/container/package.json ./packages/container/package.json
 COPY packages/docker-git-session-sync/package.json ./packages/docker-git-session-sync/package.json
 COPY packages/lib/package.json ./packages/lib/package.json
@@ -92,6 +93,7 @@ RUN set -eu; \
         --silent \
         --filter @effect-template/api \
         --filter @effect-template/lib \
+        --filter @prover-coder-ai/docker-git-auth-oauth \
         --filter @prover-coder-ai/docker-git-container \
         --filter @prover-coder-ai/docker-git-terminal \
         --filter @prover-coder-ai/docker-git-session-sync; then \
@@ -109,12 +111,14 @@ FROM workspace-deps AS workspace-static
 COPY patches ./patches
 COPY scripts ./scripts
 COPY packages/container ./packages/container
+COPY packages/auth-oauth ./packages/auth-oauth
 COPY packages/docker-git-session-sync ./packages/docker-git-session-sync
 COPY packages/lib ./packages/lib
 COPY packages/terminal ./packages/terminal
 
 RUN bun run --cwd packages/docker-git-session-sync build
 RUN bun run --cwd packages/terminal build
+RUN bun run --cwd packages/auth-oauth build
 RUN bun run --cwd packages/container build
 RUN bun run --cwd packages/lib build
 

packages/api/Dockerfile

@@ -299,6 +299,15 @@ export type CodexAuthStatus = {
   readonly account: string | null
 }
 
+export type ClaudeAuthStatus = {
+  readonly label: string
+  readonly message: string
+  readonly connected: boolean
+  readonly authPath: string
+  readonly account: string | null
+  readonly method: "none" | "oauth-token" | "claude-ai-session"
+}
+
 export type GrokAuthStatus = {
   readonly label: string
   readonly message: string

packages/api/src/api/contracts.ts

@@ -251,6 +251,20 @@ export const CodexStatusResponseSchema = Schema.Struct({
   status: CodexAuthStatusSchema
 })
 
+export const ClaudeAuthStatusSchema = Schema.Struct({
+  account: NullableStringSchema,
+  authPath: Schema.String,
+  connected: Schema.Boolean,
+  label: Schema.String,
+  message: Schema.String,
+  method: Schema.Literal("none", "oauth-token", "claude-ai-session")
+})
+
+export const ClaudeStatusResponseSchema = Schema.Struct({
+  ok: OptionalOkSchema,
+  status: ClaudeAuthStatusSchema
+})
+
 export const GrokAuthStatusSchema = Schema.Struct({
   authPath: Schema.String,
   connected: Schema.Boolean,
@@ -601,6 +615,11 @@ const AuthGroup = HttpApiGroup.make("auth")
       .setUrlParams(QueryLabelSchema)
       .addSuccess(CodexStatusResponseSchema)
   )
+  .add(
+    endpoint.get("claudeStatus", "/auth/claude/status")
+      .setUrlParams(QueryLabelSchema)
+      .addSuccess(ClaudeStatusResponseSchema)
+  )
   .add(
     endpoint.post("githubLogin", "/auth/github/login")
       .setPayload(GithubAuthLoginRequestSchema)

packages/api/src/api/openapi.ts

@@ -59,6 +59,7 @@ import {
   logoutGitAuth,
   logoutGitlabAuth,
   logoutGithubAuth,
+  readClaudeAuthStatus,
   readCodexAuthStatus,
   readGrokAuthStatus,
   readGitAuthStatus,
@@ -1138,6 +1139,15 @@ export const makeRouter = () => {
         return yield* _(jsonResponse({ status }, 200))
       }).pipe(Effect.catchAll(errorResponse))
     ),
+    HttpRouter.get(
+      "/auth/claude/status",
+      Effect.gen(function*(_) {
+        const request = yield* _(HttpServerRequest.HttpServerRequest)
+        const label = new URL(request.url, "http://localhost").searchParams.get("label")
+        const status = yield* _(readClaudeAuthStatus(label))
+        return yield* _(jsonResponse({ status }, 200))
+      }).pipe(Effect.catchAll(errorResponse))
+    ),
     HttpRouter.get(
       "/auth/menu",
       Effect.gen(function*(_) {