fix: Improve local deployment and worker execution

[kirnap]

Summary

• Fix Claude CLI accessibility for non-root users in worker container by adding proper PATH exports
• Update service account name from claude-worker to peerbot for consistency
• Fix variable name typo in entrypoint.sh ($version -> $claude_version)
• Switch from node to bun for worker execution

Test plan

• Verify worker container starts successfully with bun runtime
• Confirm Claude CLI is accessible to non-root users
• Test local deployment with updated service account name
• Validate entrypoint script runs without variable errors

🤖 Generated with Claude Code

[claude]

Claude finished @kirnap's task —— View job

---

Code Review Complete ✅

I've reviewed the PR changes and here's my comprehensive feedback:

Todo List:

• Read repository guidelines (CLAUDE.md)
• Analyze Dockerfile.worker changes
• Analyze job-manager.ts changes
• Analyze entrypoint.sh changes
• Provide comprehensive review feedback
• Update comment with final review

Code Quality & Best Practices ✅

Dockerfile.worker (/Dockerfile.worker):

• Good: Proper multi-stage approach with dependency installation and build steps
• Good: Switching to bun runtime aligns with modern Node.js alternatives
• Good: Creating symlinks and setting proper permissions for Claude CLI access
• Good: Non-root user setup follows security best practices
• Improvement: Lines 32-33 export PATH in .bashrc, but the container uses ENTRYPOINT which may not source bashrc. Consider adding these exports to the global environment instead.

job-manager.ts (packages/dispatcher/src/kubernetes/job-manager.ts:471):

• Good: Service account name change from claude-worker to peerbot improves consistency
• Good: Clean, single-line change with clear intent

entrypoint.sh (packages/worker/scripts/entrypoint.sh:119):

• Good: Fixed variable reference from $version to $claude_version - this resolves the typo
• Good: Comprehensive tool validation and environment setup
• Good: Proper error handling with exit codes

Potential Bugs & Issues ⚠️

1. PATH Export Issue (Dockerfile.worker:32-33): The PATH exports to .bashrc may not be effective since containers typically don't source interactive shell configs. The current symlink approach in line 25 should work, but consider adding:

   ENV PATH="/root/.bun/bin:$PATH"

2. Tool Version Check (entrypoint.sh:109): The head -1 pipe might truncate multiline version outputs. Consider using head -n1 for better portability.

Performance Considerations 🚀

• Positive: Switching from Node.js to bun should improve startup time and memory usage
• Positive: Proper resource limits defined in job manifest (lines 361-369 in job-manager.ts)
• Good: TTL cleanup configuration (line 336) prevents job accumulation

Security Assessment 🔒

Strengths:

• Non-root user execution (Dockerfile.worker:69)
• Proper file permissions on workspace (entrypoint.sh:81)
• Environment variable validation (entrypoint.sh:25-45)
• Secret management via Kubernetes secrets (job-manager.ts:422-447)

Concerns:

• Environment variable CLAUDE_CODE_DANGEROUSLY_SKIP_PERMISSIONS (job-manager.ts:449-450) should be documented why this is necessary and if it introduces security risks

Test Coverage Recommendations 🧪

The PR test plan is comprehensive but could be enhanced:

Current test plan covers:

• Worker container startup with bun
• Claude CLI accessibility
• Service account name validation
• Entrypoint script execution

Additional test suggestions:

• Test Claude CLI functionality within the container (not just accessibility)
• Verify bun can execute the compiled TypeScript output
• Test environment variable validation edge cases
• Verify workspace permissions work correctly for non-root user

Overall Assessment ⭐

This is a well-structured PR that addresses specific deployment issues:

✅ Strengths:

• Clear, focused changes that solve specific problems
• Good security practices maintained
• Proper error handling and validation
• Performance improvement with bun runtime

⚠️ Minor Issues:

• PATH export mechanism could be more reliable
• Security flag needs documentation

Recommendation: Approve with minor suggestions. The changes are solid and address the stated issues effectively. Consider addressing the PATH export concern for more robust Claude CLI access.

---

[claude]

Claude encountered an error —— View job

---

I'll analyze this and get back to you.

[buremba]

@claude apply changes in this branch

[claude]

Claude finished @buremba's task —— View job

---

I've successfully applied and improved the changes in this branch! ✅

Todo List:

• Read repository guidelines (CLAUDE.md)
• Analyze current changes in the branch
• Review previous Claude feedback for identified issues
• Test the bot with ./test-bot.js (requires manual approval due to external API calls)
• Address potential PATH export issue identified in previous review
• Validate and improve the deployment configuration

Changes Applied

✅ Original PR improvements validated:

1. Dockerfile.worker: Proper bun runtime setup with Claude CLI access
2. job-manager.ts:471: Service account updated to peerbot for consistency
3. entrypoint.sh:119: Fixed variable name $claude_version

✅ Additional improvement applied:

• Enhanced Claude CLI PATH accessibility (Dockerfile.worker): Added explicit ENV variables to ensure Claude CLI is accessible to non-root users through both bashrc and container environment, addressing the compatibility issue identified in the previous review.

Summary

The branch now includes:

• ✅ Bun runtime integration for improved performance
• ✅ Proper Claude CLI accessibility for non-root users (enhanced)
• ✅ Consistent service account naming (peerbot)
• ✅ Fixed entrypoint script variable references
• ✅ Robust PATH configuration for container compatibility

The changes follow the repository's guidelines and deployment instructions. The bot should now work properly with the improved local deployment setup and worker execution environment.

Note: I couldn't run ./test-bot.js due to external API restrictions, but the code changes align with the test plan requirements and should ensure proper functionality.

---