docs: authenticate the review agent in quickstart + recipe scripts - #153
Merged
Conversation
The generated quickstart (/build) and recipe (/recipes) scripts wrote the config but never logged the agent in, so the first `bubo-poller` ran with an unauthenticated agent — the poller strips the LLM key from the agent's env (anti-exfiltration allowlist), so the agent must carry its own login. Mirror action.yml's proven sequence: - Two-pass init: `bubo init --no-agent-config` seeds the workspace, then `bubo init` templates the agent profile from the written config (so a non-default llm_model actually reaches the profile). - Agent auth step: the default Codex agent logs in from the key (`codex login --with-api-key`, in-container for Docker); Claude is a custom reviewer_command that brings its own login; a `llm_base_url` gateway needs none (the key reaches the agent via LLM_API_KEY in base_url mode). Also fix the agentic install prompt's step order (write config before the profile-templating init) and add the authenticate-the-agent step.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #152. The generated /build (ScriptBuilder) and /recipes (RecipePicker) scripts wrote
env.tomlbut never authenticated the review agent, so the firstbubo-pollerran with an unauthenticated agent. The poller strips the LLM key from the agent subprocess env (theREVIEWER_ENV_ALLOWLISTanti-exfiltration defense), so the agent must carry its own login — exactly whyaction.ymlhas a dedicated login step.Fix (mirrors
action.yml)bubo init --no-agent-configseeds the workspace, then — after the config is written —bubo inittemplates the agent profile from it. This also fixes an ordering bug where a non-defaultllm_model(e.g.claude-opus-4-8) never reached the agent profile because init ran before the config was written.printf '%s' "$KEY" | codex login --with-api-key(writes~/.codex/auth.json, read back via the allowlistedCODEX_HOME). For Docker, the login runs in-container so it persists in the mounted home.reviewer_command): a note to sign in with its own login —action.ymllikewise skips auto-auth for custom commands.llm_base_url): none needed; the key reaches the agent viaLLM_API_KEYin base_url mode.Verification
next build(withNEXT_PUBLIC_BASE_PATH=/bubo) green; all 16 pages export.composeRecipeandbuildScriptdirectly (esbuild bundle) across codex/claude/self-hosted × uv/docker × mac/linux/windows — confirmed each emits the correct init sequence and the right auth line (or note) for its agent.