feat(cliproxyapi): add auth backup recovery from dotfiles - #482
Conversation
- Add rsync to cliproxyapi service dependencies - Implement recovery of missing auth files from git-tracked dotfiles backup - Only runs on macOS since Linux Docker containers rely on R2 storage - Uses --ignore-existing to avoid overwriting newer files - Helps prevent authentication issues after system resets or clean setups
📝 WalkthroughSummary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings. WalkthroughThese changes add rsync path substitution to the cliproxyapi Nix configuration and introduce macOS-specific recovery logic to both the start and backup-auth scripts. The recovery mechanism rsyncs missing auth files from a dotfiles backup directory into the local AUTH_DIR before syncing, using Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Poem
Pre-merge checks and finishing touches✅ Passed checks (3 passed)
✨ Finishing touches
🧪 Generate unit tests (beta)
📜 Recent review detailsConfiguration used: Organization UI Review profile: CHILL Plan: Pro Disabled knowledge base sources:
📒 Files selected for processing (3)
🧰 Additional context used📓 Path-based instructions (7)**/*.{sh,bash}📄 CodeRabbit inference engine (CLAUDE.md)
Files:
**/*.nix📄 CodeRabbit inference engine (CLAUDE.md)
Files:
**/default.nix📄 CodeRabbit inference engine (CLAUDE.md)
Files:
home-manager/services/*/default.nix📄 CodeRabbit inference engine (.cursor/rules/home-manager.mdc)
Files:
home-manager/services/**/default.nix📄 CodeRabbit inference engine (.cursor/rules/home-manager.mdc)
Files:
home-manager/**/*.nix📄 CodeRabbit inference engine (.cursor/rules/home-manager.mdc)
Files:
home-manager/services/**/*.nix📄 CodeRabbit inference engine (.cursor/rules/nix.mdc)
Files:
🧠 Learnings (6)📚 Learning: 2025-11-25T09:34:40.062ZApplied to files:
📚 Learning: 2025-11-25T09:34:55.014ZApplied to files:
📚 Learning: 2025-11-25T09:34:55.014ZApplied to files:
📚 Learning: 2025-11-25T09:34:55.014ZApplied to files:
📚 Learning: 2025-11-25T09:34:55.014ZApplied to files:
📚 Learning: 2025-11-25T09:34:55.014ZApplied to files:
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (13)
🔇 Additional comments (5)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Summary of ChangesHello @shunkakinoki, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request introduces a robust authentication file recovery system for the Highlights
🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
Mesa DescriptionTL;DRAdded automatic recovery of missing authentication files for the What changed?
Description generated by Mesa. Update settings |
![mesa-dot-dev[bot]](https://avatars.githubusercontent.com/in/1050077?s=60&v=4){kind=small}
There was a problem hiding this comment.
Performed full review of 5058ce9...37c9851
Tip
Help
Slash Commands:
/review- Request a full code review/review latest- Review only changes since the last review/describe- Generate PR description. This will update the PR body or issue comment depending on your configuration/help- Get help with Mesa commands and configuration options
0 files reviewed | 0 comments | Edit Agent Settings • Read Docs
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a recovery mechanism for authentication files from a local dotfiles backup on macOS, which is a good addition for resilience. The implementation adds rsync as a dependency and incorporates the recovery logic into the service start and backup scripts. My review focuses on improving the maintainability and robustness of the new shell script logic. I've pointed out some duplicated code and suggested a more reliable way to check for non-empty directories.
| if [ "$(uname)" = "Darwin" ] && [ -d "$DOTFILES_AUTH_DIR" ] && [ -n "$(ls -A "$DOTFILES_AUTH_DIR" 2>/dev/null)" ]; then | ||
| @rsync@ -a --ignore-existing "$DOTFILES_AUTH_DIR/" "$AUTH_DIR/" | ||
| echo "✅ Recovered missing auths from dotfiles backup (macOS)" >&2 | ||
| fi |
There was a problem hiding this comment.
This logic block is very similar to the one in start.sh (lines 54-57). To avoid code duplication and improve maintainability, consider extracting this logic into a common helper script. The main difference is the success message, which could be passed as an argument or handled by the calling script.
Additionally, using ls to check if a directory is empty is not fully robust, as it can misbehave with certain filenames. A more reliable method is to use find.
| if [ "$(uname)" = "Darwin" ] && [ -d "$DOTFILES_AUTH_DIR" ] && [ -n "$(ls -A "$DOTFILES_AUTH_DIR" 2>/dev/null)" ]; then | |
| @rsync@ -a --ignore-existing "$DOTFILES_AUTH_DIR/" "$AUTH_DIR/" | |
| echo "✅ Recovered missing auths from dotfiles backup (macOS)" >&2 | |
| fi | |
| if [ "$(uname)" = "Darwin" ] && [ -d "$DOTFILES_AUTH_DIR" ] && [ -n "$(find "$DOTFILES_AUTH_DIR" -mindepth 1 -maxdepth 1 -print -quit)" ]; then | |
| @rsync@ -a --ignore-existing "$DOTFILES_AUTH_DIR/" "$AUTH_DIR/" | |
| echo "✅ Recovered missing auths from dotfiles backup (macOS)" >&2 | |
| fi |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| # Recover missing files from git-tracked dotfiles backup (macOS only; Linux Docker uses R2) | ||
| if [ "$(uname)" = "Darwin" ] && [ -d "$DOTFILES_AUTH_DIR" ] && [ -n "$(ls -A "$DOTFILES_AUTH_DIR" 2>/dev/null)" ]; then | ||
| @rsync@ -a --ignore-existing "$DOTFILES_AUTH_DIR/" "$AUTH_DIR/" | ||
| echo "✅ Bootstrapped auth files from dotfiles backup (macOS)" >&2 |
There was a problem hiding this comment.
Because the dotfiles recovery block is nested inside the if [ -n "${OBJECTSTORE_ENDPOINT:-}" ] && [ -n "${OBJECTSTORE_ACCESS_KEY:-}" ] check, it never runs on macOS when objectstore credentials are unset. That defeats the new “recover from dotfiles backup” path for clean/local-only setups (exactly when you’d want it), leaving AUTH_DIR empty and causing downstream auth lookups to fail until another sync runs. Consider moving the dotfiles recovery outside the objectstore gate or relaxing the condition so it can seed auth files even when R2 creds are missing.
Useful? React with 👍 / 👎.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
2 issues found across 3 files
Prompt for AI agents (all issues)
Check if these issues are valid — if so, understand the root cause of each and fix them.
<file name="home-manager/services/cliproxyapi/scripts/start.sh">
<violation number="1" location="home-manager/services/cliproxyapi/scripts/start.sh:54">
P1: The dotfiles recovery logic is nested inside the objectstore credentials conditional block. This means recovery from dotfiles backup will never run on macOS when `OBJECTSTORE_ENDPOINT` or `OBJECTSTORE_ACCESS_KEY` are unset - precisely the clean/local-only setup scenario where this fallback recovery is most needed. Consider moving this block outside the objectstore credentials gate so it can bootstrap auth files even when R2 credentials are missing.</violation>
<violation number="2" location="home-manager/services/cliproxyapi/scripts/start.sh:55">
P1: Missing error handling for rsync command. Under `set -euo pipefail`, if rsync fails (permission issues, disk full, etc.), the entire startup script will exit and the service won't start. This should follow the same pattern as the aws s3 sync commands with `|| true` to gracefully continue on failure.</violation>
</file>
Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.
| "$AUTH_DIR/" 2>/dev/null && echo "✅ Pulled from R2 backup/auths/" >&2 || true | ||
|
|
||
| # Recover missing files from git-tracked dotfiles backup (macOS only; Linux Docker uses R2) | ||
| if [ "$(uname)" = "Darwin" ] && [ -d "$DOTFILES_AUTH_DIR" ] && [ -n "$(ls -A "$DOTFILES_AUTH_DIR" 2>/dev/null)" ]; then |
There was a problem hiding this comment.
P1: The dotfiles recovery logic is nested inside the objectstore credentials conditional block. This means recovery from dotfiles backup will never run on macOS when OBJECTSTORE_ENDPOINT or OBJECTSTORE_ACCESS_KEY are unset - precisely the clean/local-only setup scenario where this fallback recovery is most needed. Consider moving this block outside the objectstore credentials gate so it can bootstrap auth files even when R2 credentials are missing.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At home-manager/services/cliproxyapi/scripts/start.sh, line 54:
<comment>The dotfiles recovery logic is nested inside the objectstore credentials conditional block. This means recovery from dotfiles backup will never run on macOS when `OBJECTSTORE_ENDPOINT` or `OBJECTSTORE_ACCESS_KEY` are unset - precisely the clean/local-only setup scenario where this fallback recovery is most needed. Consider moving this block outside the objectstore credentials gate so it can bootstrap auth files even when R2 credentials are missing.</comment>
<file context>
@@ -49,6 +50,12 @@ if [ -n "${OBJECTSTORE_ENDPOINT:-}" ] && [ -n "${OBJECTSTORE_ACCESS_KEY:-}" ]; t
"$AUTH_DIR/" 2>/dev/null && echo "✅ Pulled from R2 backup/auths/" >&2 || true
+ # Recover missing files from git-tracked dotfiles backup (macOS only; Linux Docker uses R2)
+ if [ "$(uname)" = "Darwin" ] && [ -d "$DOTFILES_AUTH_DIR" ] && [ -n "$(ls -A "$DOTFILES_AUTH_DIR" 2>/dev/null)" ]; then
+ @rsync@ -a --ignore-existing "$DOTFILES_AUTH_DIR/" "$AUTH_DIR/"
+ echo "✅ Bootstrapped auth files from dotfiles backup (macOS)" >&2
</file context>
| @rsync@ -a --ignore-existing "$DOTFILES_AUTH_DIR/" "$AUTH_DIR/" | ||
| echo "✅ Bootstrapped auth files from dotfiles backup (macOS)" >&2 |
There was a problem hiding this comment.
P1: Missing error handling for rsync command. Under set -euo pipefail, if rsync fails (permission issues, disk full, etc.), the entire startup script will exit and the service won't start. This should follow the same pattern as the aws s3 sync commands with || true to gracefully continue on failure.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At home-manager/services/cliproxyapi/scripts/start.sh, line 55:
<comment>Missing error handling for rsync command. Under `set -euo pipefail`, if rsync fails (permission issues, disk full, etc.), the entire startup script will exit and the service won't start. This should follow the same pattern as the aws s3 sync commands with `|| true` to gracefully continue on failure.</comment>
<file context>
@@ -49,6 +50,12 @@ if [ -n "${OBJECTSTORE_ENDPOINT:-}" ] && [ -n "${OBJECTSTORE_ACCESS_KEY:-}" ]; t
+ # Recover missing files from git-tracked dotfiles backup (macOS only; Linux Docker uses R2)
+ if [ "$(uname)" = "Darwin" ] && [ -d "$DOTFILES_AUTH_DIR" ] && [ -n "$(ls -A "$DOTFILES_AUTH_DIR" 2>/dev/null)" ]; then
+ @rsync@ -a --ignore-existing "$DOTFILES_AUTH_DIR/" "$AUTH_DIR/"
+ echo "✅ Bootstrapped auth files from dotfiles backup (macOS)" >&2
+ fi
</file context>
| @rsync@ -a --ignore-existing "$DOTFILES_AUTH_DIR/" "$AUTH_DIR/" | |
| echo "✅ Bootstrapped auth files from dotfiles backup (macOS)" >&2 | |
| @rsync@ -a --ignore-existing "$DOTFILES_AUTH_DIR/" "$AUTH_DIR/" && echo "✅ Bootstrapped auth files from dotfiles backup (macOS)" >&2 || true |
There was a problem hiding this comment.
Pull request overview
This PR adds automatic recovery of authentication files from a git-tracked dotfiles backup directory, providing an additional layer of resilience for authentication file management during system resets or clean setups.
- Adds rsync as a dependency for file recovery operations
- Implements automatic recovery from
~/dotfiles/objectstore/authsduring service startup and backup - Recovery is macOS-only since Linux Docker containers rely on R2 storage
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| home-manager/services/cliproxyapi/default.nix | Added rsync binary path substitution for start.sh script |
| home-manager/services/cliproxyapi/scripts/start.sh | Added bootstrap recovery from dotfiles backup during service initialization |
| home-manager/services/cliproxyapi/scripts/backup-auth.sh | Added recovery step from dotfiles backup after R2 and CCS sync operations |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| echo "✅ Synced from ccs auth dir to local cache" >&2 | ||
| fi | ||
|
|
||
| # STEP 3: Recover missing files from git-tracked dotfiles backup (macOS only; Linux relies on R2) |
There was a problem hiding this comment.
The comment labels the recovery step as "STEP 3" but the subsequent sync operations (lines 47-77) are not labeled as "STEP 4". For consistency with the existing step numbering scheme (STEP 1 and STEP 2), consider adding a "# STEP 4:" comment before line 47 or removing the step numbering from the new STEP 3 comment.
| @rsync@ -a --ignore-existing "$DOTFILES_AUTH_DIR/" "$AUTH_DIR/" | ||
| echo "✅ Bootstrapped auth files from dotfiles backup (macOS)" >&2 | ||
| fi | ||
|
|
There was a problem hiding this comment.
The rsync command lacks error handling, which could cause the script to exit due to set -euo pipefail at line 5. If rsync fails for any reason (permissions, I/O errors, etc.), the entire startup process will fail. Consider adding error handling similar to the R2 operations, for example: @rsync@ -a --ignore-existing "$DOTFILES_AUTH_DIR/" "$AUTH_DIR/" && echo "✅ Bootstrapped auth files from dotfiles backup (macOS)" >&2 || echo "⚠️ Failed to bootstrap from dotfiles backup" >&2 || true
| @rsync@ -a --ignore-existing "$DOTFILES_AUTH_DIR/" "$AUTH_DIR/" | |
| echo "✅ Bootstrapped auth files from dotfiles backup (macOS)" >&2 | |
| fi | |
| @rsync@ -a --ignore-existing "$DOTFILES_AUTH_DIR/" "$AUTH_DIR/" && echo "✅ Bootstrapped auth files from dotfiles backup (macOS)" >&2 || echo "⚠️ Failed to bootstrap from dotfiles backup" >&2 || true | |
| fi |
| @rsync@ -a --ignore-existing "$DOTFILES_AUTH_DIR/" "$AUTH_DIR/" | ||
| echo "✅ Recovered missing auths from dotfiles backup (macOS)" >&2 |
There was a problem hiding this comment.
The rsync command lacks error handling, which could cause the script to exit due to set -euo pipefail at line 5. If rsync fails for any reason (permissions, I/O errors, etc.), the backup process will fail. Consider adding error handling similar to the R2 operations, for example: @rsync@ -a --ignore-existing "$DOTFILES_AUTH_DIR/" "$AUTH_DIR/" && echo "✅ Recovered missing auths from dotfiles backup (macOS)" >&2 || echo "⚠️ Failed to recover from dotfiles backup" >&2 || true
Summary
--ignore-existingflag to avoid overwriting newer files from other sourcesChanges
Technical Details
The recovery mechanism checks for missing auth files in the git-tracked dotfiles directory (
~/dotfiles/objectstore/auths) and restores them using rsync with--ignore-existingto preserve any newer files from R2 or CCS directories. This provides an additional layer of resilience for authentication file management.Summary by cubic
Add automatic recovery of missing auth files from a git-tracked dotfiles backup on macOS to prevent auth errors after resets. Includes rsync in the cliproxyapi service and bootstraps recovery in start.sh and backup-auth.sh using --ignore-existing to avoid overwriting newer files.
Written for commit 37c9851. Summary will update on new commits.