Skip to content

Commit 6341d4c

Browse files
gatezhgatezh
authored
Merge pull request #168 from gatezh/fix/rtk-init-hardening
fix(rtk): init the hook without /mnt/claude in ralphex-fe; close stdin at all rtk init sites
2 parents 7979439 + 056d8d9 commit 6341d4c

3 files changed

Lines changed: 23 additions & 26 deletions

File tree

‎.devcontainer/init-plugins.sh‎

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -46,13 +46,11 @@ done
4646

4747
# Initialize rtk global hook for Claude Code (auto-rewrite mode).
4848
# --hook-only: installs only the PreToolUse rewrite hook, no workspace artifacts.
49-
# RTK_TELEMETRY_DISABLED=1 is the supported opt-out, not a workaround: since
50-
# rtk-ai/rtk#2477 (v0.44.0+) it short-circuits the telemetry consent prompt that
51-
# would otherwise block on stdin here. rtk's own TTY check is not enough — a
52-
# devcontainer postCreateCommand gets a pseudo-TTY, so the prompt believes it is
53-
# interactive. timeout stays as a backstop against a future init-time hang.
49+
# Telemetry consent prompt: RTK_TELEMETRY_DISABLED=1 opts out (rtk-ai/rtk#2477),
50+
# closed stdin defeats the pseudo-TTY postCreateCommand hands us, and timeout
51+
# backstops any other init-time hang.
5452
echo "Initializing rtk (token optimizer)..."
55-
RTK_TELEMETRY_DISABLED=1 timeout 10 rtk init -g --hook-only --auto-patch || {
53+
RTK_TELEMETRY_DISABLED=1 timeout 10 rtk init -g --hook-only --auto-patch < /dev/null || {
5654
echo "Note: rtk init may have already been configured or rtk not available"
5755
}
5856

‎claude-code/.devcontainer/init-plugins.sh‎

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -76,13 +76,11 @@ done
7676
# ── rtk init (token-optimized CLI proxy) ────────────────────────────────────
7777
# Global hook-first mode: installs only the PreToolUse rewrite hook to ~/.claude/,
7878
# no workspace artifacts (CLAUDE.md, .rtk/). Safe to run multiple times.
79-
# RTK_TELEMETRY_DISABLED=1 is the supported opt-out, not a workaround: since
80-
# rtk-ai/rtk#2477 (v0.44.0+) it short-circuits the telemetry consent prompt that
81-
# would otherwise block on stdin here. rtk's own TTY check is not enough — a
82-
# devcontainer postCreateCommand gets a pseudo-TTY, so the prompt believes it is
83-
# interactive. timeout stays as a backstop against a future init-time hang.
79+
# Telemetry consent prompt: RTK_TELEMETRY_DISABLED=1 opts out (rtk-ai/rtk#2477),
80+
# closed stdin defeats the pseudo-TTY postCreateCommand hands us, and timeout
81+
# backstops any other init-time hang.
8482
if command -v rtk &>/dev/null; then
85-
RTK_TELEMETRY_DISABLED=1 timeout 10 rtk init -g --hook-only --auto-patch 2>/dev/null || true
83+
RTK_TELEMETRY_DISABLED=1 timeout 10 rtk init -g --hook-only --auto-patch < /dev/null 2>/dev/null || true
8684
fi
8785

8886
# ── agent-browser skill ─────────────────────────────────────────────────────

‎ralphex-fe/init-docker.sh‎

Lines changed: 15 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -3,11 +3,17 @@
33
# The entrypoint (/init.sh) runs /srv/init.sh if it exists before the main command.
44
#
55
# Source: https://github.com/umputun/ralphex/blob/master/scripts/internal/init-docker.sh
6-
# Copied as-is from umputun/ralphex. Check upstream for updates.
6+
# Copied from umputun/ralphex; local additions are marked "Local:" or cite
7+
# an issue. Check upstream for updates.
8+
9+
# ── Local: ~/.claude must exist without the host mount (#128) ───────────────
10+
# rtk init -g below writes into it (as app) and fails if it is missing. Not
11+
# recursive: only the copies below are chowned, never anything bind-mounted in.
12+
mkdir -p /home/app/.claude
13+
chown app:app /home/app/.claude
714

815
# copy only essential claude files (not the entire 2GB directory)
916
if [ -d /mnt/claude ]; then
10-
mkdir -p /home/app/.claude
1117
# copy config files only (not cache, history, debug, todos, etc.)
1218
for f in .credentials.json settings.json settings.local.json CLAUDE.md format.sh; do
1319
[ -e "/mnt/claude/$f" ] && cp -L "/mnt/claude/$f" "/home/app/.claude/$f" 2>/dev/null || true
@@ -27,19 +33,14 @@ if [ -d /mnt/claude ]; then
2733
fi
2834

2935
chown -R app:app /home/app/.claude
36+
fi
3037

31-
# ── RTK: ensure rewrite hook is configured ─────────────────────────────
32-
# The host mount usually brings the hook; re-init idempotently in case the
33-
# mounted ~/.claude carries none. --hook-only avoids workspace artifacts.
34-
# Scope: this sits inside the /mnt/claude guard, so a container started
35-
# without the host mount gets no rtk hook and rtk stays inert.
36-
# RTK_TELEMETRY_DISABLED=1 is the supported opt-out, not a workaround:
37-
# since rtk-ai/rtk#2477 (v0.44.0+) it short-circuits the telemetry consent
38-
# prompt that would otherwise block on stdin here. timeout stays as a
39-
# backstop against a future init-time hang.
40-
if command -v rtk >/dev/null 2>&1; then
41-
RTK_TELEMETRY_DISABLED=1 gosu app timeout 10 rtk init -g --hook-only --auto-patch 2>/dev/null || true
42-
fi
38+
# ── Local: RTK rewrite hook, with or without the host mount (#128) ──────────
39+
# Idempotent; --hook-only avoids workspace artifacts. Telemetry prompt:
40+
# RTK_TELEMETRY_DISABLED=1 opts out (rtk-ai/rtk#2477), closed stdin stops it
41+
# blocking, and timeout backstops any other hang.
42+
if command -v rtk >/dev/null 2>&1; then
43+
RTK_TELEMETRY_DISABLED=1 gosu app timeout 10 rtk init -g --hook-only --auto-patch < /dev/null 2>/dev/null || true
4344
fi
4445

4546
# copy credentials extracted from macOS keychain (mounted separately)

0 commit comments

Comments
 (0)