Feat/dock add codex - #1502
Conversation
… python Symlinks cause Python to resolve the real binary path, losing the venv's pyvenv.cfg and site-packages. Wrapper scripts exec the venv python directly so the venv context is preserved. Closes the "No module named mempalace" error.
mkIf requires the NixOS module system to evaluate correctly. Importing eagerly bypasses module merging and causes build hangs.
…host Ollama was binding to 0.0.0.0 on all hosts with no authentication, exposing the inference API to the network. Restrict to laptops only and bind to 127.0.0.1.
Nix sandbox was disabled, allowing build scripts to read/write arbitrary host paths without filesystem isolation.
Paperclip was binding to all interfaces on kyber. Since it sits behind ingress (paperclip.shunkakinoki.com), it only needs localhost.
Activation script finds all .env files under $HOME (up to 4 levels deep) and sets permissions to 600 on every home-manager switch. Prevents secrets from being world-readable.
The hardcoded /etc/profiles/per-user path only exists on NixOS. Search PATH for the next python3 that isn't the wrapper itself, so it works on both NixOS and non-NixOS hosts.
The old code created symlinks from python3-<tool> to the venv python. When the new wrapper code does cat > python3-<tool>, bash follows the symlink and overwrites the target (the uv cpython binary), corrupting every venv. Remove the old symlink first so cat creates a regular file.
…' into feat/dock-add-codex # Conflicts: # home-manager/services/docker-postgres/default.nix
|
Warning Rate limit exceeded
Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 52 minutes and 54 seconds. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThis PR introduces cross-platform improvements, new configuration modules, and service enhancements: adds mempalace and secure-dotenv modules, enables SSH clipboard via OSC 52, adds Darwin support to decafinate, refactors the python3 dispatcher, updates Claude permission modes from bypassPermissions to auto, conditionally gates services based on host type, changes service bind addresses to 127.0.0.1, updates the dotagents submodule, and reorganizes module imports. Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Suggested labels
🚥 Pre-merge checks | ❌ 3❌ Failed checks (3 warnings)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
You do not have enough credits to review this pull request. Please purchase more credits to continue. |
Mesa DescriptionTL;DRAdded Codex to the macOS Dock and shipped several hardening and UX improvements, including a new What changed?
Description generated by Mesa. Update settings |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces several configuration updates and script improvements across the repository. Key changes include enabling the Nix sandbox, adding a new mempalace module, refactoring the decafinate script to support macOS, and implementing a secure-dotenv module to enforce strict permissions on environment files. Additionally, several services like ollama and paperclip were restricted to localhost for improved security, and OSC 52 support was added for remote clipboard operations. Feedback focuses on improving the portability of the mempalace configuration using Nix-generated JSON, ensuring robust filename handling in shell scripts using null delimiters, and refining PID file checks in the decafinate script to prevent shell errors.
| { ... }: | ||
| { | ||
| home.file.".mempalace/config.json" = { | ||
| source = ./config.json; | ||
| force = true; | ||
| }; | ||
| } |
There was a problem hiding this comment.
The configuration for mempalace currently relies on a static JSON file with a hardcoded home directory path. To improve portability across different users and environments, it is better to generate the JSON content dynamically using Nix and the config.home.homeDirectory option.
{ config, ... }:
{
home.file.".mempalace/config.json" = {
text = builtins.toJSON {
palace = "${config.home.homeDirectory}/ghq/github.com/shunkakinoki/wiki";
};
force = true;
};
}
| ${pkgs.findutils}/bin/find "${homeDir}" \ | ||
| -maxdepth 4 \ | ||
| -name '.env' -o -name '.env.*' -o -name '*.env' \ | ||
| 2>/dev/null | while IFS= read -r f; do |
There was a problem hiding this comment.
Parsing find output with a standard while read loop can fail if filenames contain spaces or newlines. Using -print0 and read -d '' is a more robust approach for handling arbitrary filenames, as recommended in the general rules for shell scripts in this repository.
${pkgs.findutils}/bin/find "${homeDir}" \
-maxdepth 4 \
\( -name '.env' -o -name '.env.*' -o -name '*.env' \) \
-print0 2>/dev/null | while IFS= read -r -d "" f; do
References
- To robustly parse command output in shell scripts, use a unique delimiter (e.g., tab) in the format string and
readwith a matchingIFS. This is safer than splitting by spaces withcut, especially when data fields might contain spaces.
| systemctl --user is-active --quiet "$UNIT_FILE" | ||
| case "$OS" in | ||
| Darwin) | ||
| if [[ -f $PID_FILE ]] && kill -0 "$(cat "$PID_FILE")" 2>/dev/null; then |
There was a problem hiding this comment.
Checking for file existence with [[ -f $PID_FILE ]] is insufficient if the file is empty, as kill -0 will then be called with an empty argument, leading to a shell error. Using [[ -s $PID_FILE ]] ensures the file exists and contains data before attempting to read the PID.
| if [[ -f $PID_FILE ]] && kill -0 "$(cat "$PID_FILE")" 2>/dev/null; then | |
| if [[ -s $PID_FILE ]] && kill -0 "$(cat "$PID_FILE")" 2>/dev/null; then |
# Conflicts: # home-manager/modules/local-scripts/decafinate.sh
1 participant
Summary by cubic
Add Codex to the macOS Dock and ship several hardening and UX improvements. Includes a new
mempalaceconfig, macOS support fordecafinate, safer local service defaults, SSH-friendly clipboard copy, and reliableuvPython wrappers that fix module import errors.New Features
Codex.appto the macOS Dock (between ChatGPT and Claude).mempalacehome-manager module with config at~/.mempalace/config.json.decafinate(usescaffeinatewith PID-based control).Bug Fixes
uv-globals: switched to wrapper scripts and a PATH-basedpython3dispatcher (removes stale symlinks); fixes “No module named mempalace” and avoids venv corruption.ollamaandpaperclipto127.0.0.1; limitedollamato laptops and disableddocker-postgreson Galactica/Matic; addedsecure-dotenvto enforce 600 perms on.envfiles.Written for commit d629b3c. Summary will update on new commits.