Follow-up from the review of #7. Spec-affecting: needs an OpenSpec change with a delta on gh-auth-proxy → Sessions are isolated and cleaned up.
Three problems that all hinge on sidecar lifecycle:
1. Orphaned sidecars are never reaped (observed in practice)
EXIT traps cannot run on SIGKILL, and the startup prune deliberately skips running claude-gh-proxy-* containers so it can never sever a concurrent live session. Net effect: a hard-killed run.sh strands a running sidecar holding the real host token, indefinitely, with no TTL.
Observed during development: claude-gh-proxy-dpzfHL still up 27 minutes after its session died.
Proposal: label sidecars with a creation timestamp at run time, and have the prune remove running sidecars older than a threshold (or whose session is demonstrably dead). That resolves the current tension between "never kill a live session" and "never strand a token holder".
2. No supervision — a mid-session crash fails confusingly
If Caddy crashes mid-session, all GitHub access breaks with connection refused, because --add-host still points at the dead IP, while gh believes it is authenticated. There is no --restart policy. At minimum document the failure mode; consider --restart=on-failure (now possible since --rm was dropped in #7).
3. Audit log does not survive teardown
The audit log is stdout-only on an ephemeral container, which undercuts its stated IR purpose: after the session exits, the evidence is gone. Cheap fix: tee it to the (already host-writable) stage dir, ideally behind a flag.
Also
Document the manual cleanup one-liner for stranded sidecars/networks (docker rm -f claude-gh-proxy-<id> / docker network rm claude-gh-<id>).
Follow-up from the review of #7. Spec-affecting: needs an OpenSpec change with a delta on
gh-auth-proxy→ Sessions are isolated and cleaned up.Three problems that all hinge on sidecar lifecycle:
1. Orphaned sidecars are never reaped (observed in practice)
EXIT traps cannot run on
SIGKILL, and the startup prune deliberately skips runningclaude-gh-proxy-*containers so it can never sever a concurrent live session. Net effect: a hard-killedrun.shstrands a running sidecar holding the real host token, indefinitely, with no TTL.Observed during development:
claude-gh-proxy-dpzfHLstill up 27 minutes after its session died.Proposal: label sidecars with a creation timestamp at
runtime, and have the prune remove running sidecars older than a threshold (or whose session is demonstrably dead). That resolves the current tension between "never kill a live session" and "never strand a token holder".2. No supervision — a mid-session crash fails confusingly
If Caddy crashes mid-session, all GitHub access breaks with
connection refused, because--add-hoststill points at the dead IP, whileghbelieves it is authenticated. There is no--restartpolicy. At minimum document the failure mode; consider--restart=on-failure(now possible since--rmwas dropped in #7).3. Audit log does not survive teardown
The audit log is stdout-only on an ephemeral container, which undercuts its stated IR purpose: after the session exits, the evidence is gone. Cheap fix:
teeit to the (already host-writable) stage dir, ideally behind a flag.Also
Document the manual cleanup one-liner for stranded sidecars/networks (
docker rm -f claude-gh-proxy-<id>/docker network rm claude-gh-<id>).