arcodangeandClaude Opus 5
2e699e1fc6
Completes the role model on the sandbox side, and closes the third failure of the 2026-07/08 sessions: a refresh wiped hand-granted rights and nothing recorded them, so the sandbox silently lost capabilities nobody had written down. - Provisioned `ai_agent_sandbox_read` (36 rights) and `ai_agent_sandbox_sandbox_write` (44 rights) from test/scopes.ts. Verified functionally on the live sandbox: the reader reads and gets 403 on invoice creation; the writer creates a draft and gets 403 on DELETE. - checkpoint-provision.sh now re-creates both scoped agents after every refresh, so their rights come from code rather than from someone's memory. Failure to provision a scope warns instead of aborting the whole checkpoint. - checkpoint-relink-env.sh points the write skill at the scoped writer key, falling back to the legacy single-user key so an older checkout still works. The write skill now operates as ai_agent_sandbox_sandbox_write (id 6). Smoke-tested end to end after the credential swap: the promote pipeline rehearses on the sandbox under the scoped writer, and `apply` still refuses without a recorded human gate. The redundant `ai_agent_prod_prod_write` login is documented as deliberate: renaming a provisioned production credential means creating a second privileged user and repointing the promote flow — churn for cosmetics. Left behind in the sandbox: draft invoice id=19, a scope probe. It cannot be deleted (no scope grants DELETE, which is the point) and the next refresh reclaims it. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01VRShc4QhLLU73FLHx9vskh
37 lines
2.0 KiB
Bash
Executable File
37 lines
2.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Re-provision the ai_agent_sandbox write user after a refresh, then relink the
|
|
# write skill .env. Runs the Playwright POC (test/provisionSandbox.ts): it opens a
|
|
# browser — YOU complete the admin login.
|
|
#
|
|
# IMPORTANT: the sandbox is iso-prod, so log in with the PROD admin credentials.
|
|
# Those come from test/.env.sandbox (DOLI_ADMIN_LOGIN / DOLI_ADMIN_PASSWORD) — make
|
|
# sure they are prod's. The POC re-grants the agent's rights (incl. banque lire) and
|
|
# writes the new key to test/.ai_agent_sandbox.key.
|
|
set -euo pipefail
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
ROOT="${ARCO_ROOT:-$(cd "${SCRIPT_DIR}/../../../.." && pwd)}"
|
|
POC="${ROOT}/test/provisionSandbox.ts"
|
|
|
|
command -v deno >/dev/null || { echo "checkpoint-provision: deno not found (https://deno.land)" >&2; exit 1; }
|
|
[[ -f "${POC}" ]] || { echo "checkpoint-provision: missing ${POC}" >&2; exit 1; }
|
|
[[ -f "${ROOT}/test/.env.sandbox" ]] || echo "checkpoint-provision: WARN no test/.env.sandbox (admin creds) — login may fail" >&2
|
|
|
|
echo ">>> launching provisionSandbox.ts — complete the admin login in the browser (use PROD admin creds)"
|
|
( cd "${ROOT}/test" && deno run --allow-all provisionSandbox.ts )
|
|
|
|
# Scoped agents (test/scopes.ts). A refresh wipes every user, so they are
|
|
# re-created here rather than granted by hand — the 2026-07 failure where a
|
|
# refresh silently dropped hand-granted rights and nothing recorded it.
|
|
if [[ -f "${ROOT}/test/provisionAiUser.ts" ]]; then
|
|
for scope in read sandbox-write; do
|
|
echo ">>> provisioning scoped sandbox agent: ${scope}"
|
|
( cd "${ROOT}/test" \
|
|
&& DOLIBARR_ADDRESS="${DOLIBARR_SANDBOX_URL:-https://erp-sandbox.arcodange.lab}" \
|
|
deno run --allow-all provisionAiUser.ts --scope "${scope}" --env sandbox ) \
|
|
|| echo " WARN: scoped provisioning failed for '${scope}' — check test/scopes.ts" >&2
|
|
done
|
|
fi
|
|
|
|
echo ">>> provisioning finished; relinking the write skill .env"
|
|
exec "${SCRIPT_DIR}/checkpoint-relink-env.sh"
|