Repository navigation
Read the Redrob Launcher shared account as the last console-key fallback - #87
Closed
its-janghoon wants to merge 1 commit into
Closed
its-janghoon wants to merge 1 commit into
its-janghoon wants to merge 1 commit into
Conversation
Redrob Launcher signs a computer in once and writes the workspace key to a shared account.json (Linux $XDG_CONFIG_HOME/redrob-shared, macOS ~/Library/Application Support/ai.redrob.shared, Windows %APPDATA%\Redrob\Shared; REDROB_SHARED_DIR replaces the directory). The contract is redrob-launcher docs/shared-account.md: read-only, read fresh on every use, the app's own key wins, empty/missing/malformed means not signed in, never log the key. core/shared-account.ts is the one reader: path resolution, parsing, and a read() that hits the disk every call. It never writes or deletes the file. Every console-key consumer now ends its chain at that file: - ConsoleKey.resolve keeps its signature and gains resolveWithSource, which reports where the key came from: env | credential | api | launcher. - ModelsDev.resolveApiKey reads it fourth, after REDROB_API_KEY, the Credential store and auth.json, so the dynamic catalogue is served to a launcher-only sign-in instead of the six-id fallback. - The V1 provider list merges the redrob provider with source "launcher" and the key when nothing of the app's own is present (no env, no auth.json entry, no config apiKey), and the redrob loader counts it as a credential so the "public" placeholder is not set. GET /provider therefore reports the redrob entry with source: "launcher" and a resolved key, which is what a host app reads to show "Signed in with Redrob Launcher". The Info schema and the generated SDK/plugin types gain the literal. DELETE /auth/redrob still removes only the engine's auth.json entry; the next read falls back to the shared file, which stays untouched. Both test preloads point REDROB_SHARED_DIR at a scratch directory: the core "no key" ModelsDev tests failed on this machine for the same reason the preload already isolates XDG_DATA_HOME, a real launcher sign-in in ~/.config. New tests cover no key anywhere, shared only, env wins, auth.json wins, malformed/empty files, and a file removed between two resolves.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Redrob Launcher signs a computer in once and writes the workspace key to a shared
account.json(contract: redrob-launcherdocs/shared-account.md;REDROB_SHARED_DIRoverrides the directory). Redrob Code now reads it as the LAST fallback for the console key, read-only and fresh on every use.packages/core/src/shared-account.ts: the one reader (platform path, parse,read()with no cache). Never writes or deletes the file.ConsoleKey.resolvekeeps its signature; newConsoleKey.resolveWithSourcereturns{ key, source }withsource: "env" | "credential" | "api" | "launcher".ModelsDev.resolveApiKeyreads the shared file fourth (env, Credential store, auth.json, then launcher), so a launcher-only sign-in gets the live catalogue instead of the six-id fallback.GET /provider): when nothing of the app's own is present (noREDROB_API_KEY, no auth.json entry, no config apiKey) theredrobentry is reported withsource: "launcher"and the resolvedkey, and the loader no longer sets theoptions.apiKey: "public"placeholder.Provider.Info.sourceand the generated SDK/plugin types gain thelauncherliteral. Existingenv/api/config/customsemantics and thepublicsentinel are unchanged.DELETE /auth/redrobstill removes only the engine's auth.json entry; the next read falls back to the shared file, which is left untouched.Tests
packages/core/test/console-key.test.ts(new, 13): no key anywhere; shared only -> key + source launcher; env wins; auth.json wins over shared; auth.json removed -> falls back, shared file untouched; malformed/empty file; file removed between two resolves is seen (no cache). All againstREDROB_SHARED_DIRin a scratch dir.packages/redrob/test/provider/provider.test.ts(+4): provider reportsource: launcher+ key with nopublicplaceholder; absent/empty shared file keepscustom+public; env wins; auth.json wins and removing it falls back to launcher.REDROB_SHARED_DIRat a scratch dir. Without that, the core "no key" ModelsDev tests fail on a machine whose launcher is signed in (reproduced here), the same leak the preload already isolatesXDG_DATA_HOMEfor.bun turbo typecheck18/18; oxlint 0 errors on touched files.