arcodangeandClaude Fable 5
0240c519b1
The checkpoint status/relink-env armed probe calls GET /users/info, which requires Dolibarr right 251 (user->user->lire). WRITE_IDS didn't include it, so a freshly provisioned agent answered 403 on the probe — reported NOT armed — while its key actually authenticates (GET /thirdparties -> 200). Right 251 was granted live in SQL on the sandbox (fk_user=4) today; this persists it in WRITE_IDS so every future provision grants it. Also teach both probes to tell the failure modes apart instead of one opaque message: 401 = key rejected (stale/instance-encrypted -> re-provision), 403 = key OK but right 251 missing (-> grant it / re-provision), 200 = armed. Docs updated accordingly (checkpoint SKILL.md probe outcomes, sandbox-write SKILL.md gotcha, test/README.md rights table synced to WRITE_IDS incl. 262/111). Co-Authored-By: Claude Fable 5 <[email protected]>
38 lines
1.8 KiB
Bash
Executable File
38 lines
1.8 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Report the erp-sandbox checkpoint state: HTTP liveness + whether the write agent
|
|
# (ai_agent_sandbox) is armed (its key authenticates). Read-only, no cluster access.
|
|
set -uo pipefail
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
ROOT="${ARCO_ROOT:-$(cd "${SCRIPT_DIR}/../../../.." && pwd)}"
|
|
SB_URL="${DOLIBARR_SANDBOX_URL:-https://erp-sandbox.arcodange.lab}"
|
|
WRITE_ENV="${ROOT}/.claude/skills/dolibarr-sandbox-write/.env"
|
|
DOLW="${ROOT}/.claude/skills/dolibarr-sandbox-write/scripts/dol-write.sh"
|
|
KEY="${ROOT}/test/.ai_agent_sandbox.key"
|
|
|
|
echo "erp-sandbox checkpoint status"
|
|
code=$(curl -s -o /dev/null -w '%{http_code}' --max-time 10 "${SB_URL}/" 2>/dev/null || echo "---")
|
|
echo " HTTP : ${code} (${SB_URL})"
|
|
echo " agent key file : $([ -s "${KEY}" ] && echo "present" || echo "absent (provision needed)")"
|
|
if [[ -f "${WRITE_ENV}" ]]; then
|
|
echo " write .env : present"
|
|
printf ' write agent : '
|
|
"${DOLW}" GET /users/info 2>/dev/null | python3 -c "import json,sys
|
|
try:
|
|
d = json.load(sys.stdin)
|
|
except Exception:
|
|
print('NOT armed — no/invalid response'); sys.exit(0)
|
|
if isinstance(d, dict) and d.get('login'):
|
|
print('ARMED — login=%s id=%s' % (d['login'], d.get('id'))); sys.exit(0)
|
|
err = d.get('error', {}) if isinstance(d, dict) else {}
|
|
code = str(err.get('code', ''))
|
|
if code == '401':
|
|
print('NOT armed — 401 key rejected (stale after a refresh?) → run checkpoint provision')
|
|
elif code == '403':
|
|
print('NOT armed — 403 key OK but right 251 (user lire) missing → re-provision or grant 251 (WRITE_IDS, test/provisionSandbox.ts)')
|
|
else:
|
|
print('NOT armed — %s' % str(err.get('message', 'unexpected'))[:80])"
|
|
else
|
|
echo " write .env : ABSENT"
|
|
echo " write agent : not linked — run 'arcodange sandbox checkpoint relink-env' after provisioning"
|
|
fi
|