arcodange-org/erp
1
0
Fork 0
Code Issues 18 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

fix(provision): grant user lire (251) to ai_agent_sandbox so the armed probe passes

Browse Source 
The checkpoint status/relink-env armed probe calls GET /users/info, which
requires Dolibarr right 251 (user->user->lire). WRITE_IDS didn't include it,
so a freshly provisioned agent answered 403 on the probe — reported NOT armed
— while its key actually authenticates (GET /thirdparties -> 200). Right 251
was granted live in SQL on the sandbox (fk_user=4) today; this persists it in
WRITE_IDS so every future provision grants it.

Also teach both probes to tell the failure modes apart instead of one opaque
message: 401 = key rejected (stale/instance-encrypted -> re-provision),
403 = key OK but right 251 missing (-> grant it / re-provision), 200 = armed.
Docs updated accordingly (checkpoint SKILL.md probe outcomes, sandbox-write
SKILL.md gotcha, test/README.md rights table synced to WRITE_IDS incl. 262/111).

Co-Authored-By: Claude Fable 5 <[email protected]>
This commit is contained in:
arcodange
2026-07-11 17:38:30 +02:00
co-authored by Claude Fable 5
parent 3045d50626
commit 0240c519b1
6 changed files with 37 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.claude/skills/dolibarr-sandbox-checkpoint/scripts/checkpoint-relink-env.sh
+9 -3
View File
@@ -24,7 +24,13 @@ printf 'verify: '
"${DOLW}" GET /users/info | python3 -c "import json,sys
d = json.load(sys.stdin)
if isinstance(d, dict) and d.get('login'):
print('OK — armed as %s (id %s)' % (d['login'], d.get('id')))
print('OK — armed as %s (id %s)' % (d['login'], d.get('id'))); sys.exit(0)
err = d.get('error', {}) if isinstance(d, dict) else {}
code = str(err.get('code', ''))
if code == '401':
print('FAILED — 401 key rejected (stale/instance-encrypted) → re-run checkpoint provision')
elif code == '403':
print('FAILED — 403 key authenticates but right 251 (user lire) is missing → re-provision or grant 251 (WRITE_IDS, test/provisionSandbox.ts)')
else:
msg = d.get('error', {}).get('message', '?') if isinstance(d, dict) else str(d)
print('FAILED — %s' % msg); sys.exit(1)"
print('FAILED — %s' % (err.get('message', '?') if isinstance(d, dict) else str(d)))
sys.exit(1)"