fix(env): fail-closed Cloud Agent start and hash-locked install - #427
Draft
cursor[bot] wants to merge 7 commits into
Draft
fix(env): fail-closed Cloud Agent start and hash-locked install#427cursor[bot] wants to merge 7 commits into
cursor[bot] wants to merge 7 commits into
Conversation
Add repo-managed .cursor/environment.json plus install/start scripts so Cloud Agents boot fully set up for both the Python CLI/web/MCP package and the Rust core backend: - install.sh: ensure ffmpeg, add rustfmt, pip --user install the package with web/mcp/dev + test deps, build the rust-core release binary, and put ~/.local/bin on PATH for non-login shells. - start.sh: rebuild codec-carver-core if a fresh checkout wiped rust-core/target. - environment.json: run the FastAPI SaaS web service (saas_web:app) on 0.0.0.0:8000 and expose the port. Validated end-to-end: 631 Python tests, 22 Rust tests, cargo fmt, the codec-carver CLI (FLAC + Opus fallback), the codec-carver-library Rust bridge, and a browser upload through the web UI. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
A prebuilt-build/snapshot boot does not always replay the environment.json terminals, so the FastAPI service could be down on boot. Launch it from start.sh (guarded single-instance, backgrounded, logs to /tmp/codec-carver-web.log) so it comes up on every boot mode, and drop the terminals entry to avoid a double bind on port 8000. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
Wait on GET /health before start exits, install rustfmt without || true, and match CI's require-hashes pip contract so a green environment boot means the SaaS UI is actually listening. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
Author
There was a problem hiding this comment.
This is the environment landing vehicle for #426. Head 404b1b9 has the fail-closed rustfmt install, hash-locked pip contract, repo-root cd, auth-exempt GET /health, and a start that waits or exits non-zero.
Next actions:
- Keep this PR as the named environment head. Do not open a third environment PR and do not merge #426 at
8a60d4a. - After required checks finish on this head, mark ready for review. Do not self-approve.
- Residual risk:
_web_is_readydepends oncurl. If a future base image omits it,startfail-closes (correct) but never becomes ready. A follow-up can probe withpython3/urllibso the wait uses the same interpreter as uvicorn. - Residual risk:
requirements-dev.txtis still unhashed. That matches CI’s test-tool install; do not weaken the runtime lock to “fix” it. - Do not mix credential-registry (#329/#373) or drop-zone (#428) work into this branch.
Sent by Cursor Automation: Fix Issues
This was referenced Aug 16, 2026
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Add the fail-closed regression first: unattended Cloud Agent bootstrap may use the repository hash lock or the offline editable tree, but must not install the unhashed requirements-dev.txt surface.
Satisfy the supply-chain review at its causal boundary: unattended setup now matches CI exactly by installing only the authenticated requirements lock and the offline editable tree. Keep requirements-dev.txt opt-in until it has its own reviewed hash lock.
opencode-agent
Bot
added
priority: medium
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Successor to #426. Keeps the repo-managed Cloud Agent environment and makes a green
startmean the SaaS UI is actually listening..cursor/install.shnowcds to the repository root, installs Python with--require-hashes -r requirements-lock.txtthen--no-index --no-deps -e .(same contract as CI), and addsrustfmtfail-closed..cursor/start.shrebuildscodec-carver-coreonly when missing, startssaas_web:appon0.0.0.0:8000, and waits onGET /health. It exits non-zero if uvicorn dies or the probe times out.GET /healthreturns{"status":"ok","service":"codec-carver"}and stays auth-exempt like the upload page so load balancers and Cloud Agent start can probe without a key.ARCHITECTURE.mdanddocs/doctoring/cloud-agent-environment.mdrecord the install/start split, job-store ERD debt, and APA 7th citations (NIST SP 800-218, SLSA v1.0, pip hash-checking).Why
#426 at
e0ca48freturned fromstartimmediately afternohup, swallowed rustfmt failures with|| true, and resolved extras from PyPI without the hash lock. A Cloud Agent could report a successful boot while:8000was dead, andcargo fmt --checkcould be missing.Validation
python3 -m unittest tests.test_cloud_agent_environment tests.test_saas_web.TestApiKeyAuth -v— 18 passedpython3 -m unittest tests.test_saas_web -v— 76 passedpython3 -m interrogate saas_web.py— 100%bash -n .cursor/install.sh .cursor/start.sh— cleanGET http://127.0.0.1:8010/health—{"status":"ok","service":"codec-carver"}Notes
CODEC_CARVER_API_KEYS/ issues security: migrate runtime API keys to a credential registry #329 and [Security] Add a typed, fail-closed API credential registry and rotation contract #373) into this change.jobsremains known naming debt (conversion_jobs); out of scope here.