External/roboco
1
0
Fork 0
mirror of https://github.com/rennf93/roboco.git synced 2026-08-03 07:23:24 +02:00
Code Issues Packages Projects Releases Wiki Activity

feat(grok): auto-refresh the SuperGrok token + fail fast on a dead one

Browse Source 
The grok access token has a ~6h server-set TTL (the client cannot lengthen it),
the CLI has no refresh command, and headless 'grok -p' does NOT self-refresh an
expired token -- it hangs forever at an interactive 'Waiting for authorization...'
prompt. Live evidence: a fleet went silent within ~3 min of the token's 06:54
expiry, every agent a zombie hung at the prompt, requiring a manual 'grok login'.

- grok_auth.refresh_if_stale: mint a fresh access token from the offline_access
  refresh token via xAI's OIDC refresh_token grant (https://auth.x.ai/oauth2/token),
  atomically rewriting auth.json. The orchestrator runs it once per dispatch tick
  (serial -> no concurrent refresh-token rotation race; throttled to 60s), keeping
  the host credential live so agents never mount a dead one. No more manual login.
- Entrypoint --check guard: refuse to run (exit 78) on a missing/expired token
  instead of hanging for hours -- surfaced to _handle_stopped_container.
- Orchestrator grok-dir mount flipped read-only -> read-write in all three compose
  files so the refresh can rewrite auth.json; the per-agent file mount stays RO.

Verified: 10 unit tests; the --check guard exits 0/1/1 (valid/expired/missing)
inside the real roboco-agent-grok image. Gate green (ruff/mypy/xenon).
This commit is contained in:
Renn F
2026-06-19 10:15:58 +02:00
parent 5ea2f82f64
commit f2e787c577
8 changed files with 439 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docker-compose.registry.yml
+4 -2
View File
@@ -242,8 +242,10 @@ services:
- ${CLAUDE_AUTH_DIR:-${HOME}/.claude}:/root/.claude
# SuperGrok auth — mount host ~/.grok at the SAME host path the orchestrator
# hands each Grok agent's `-v`, so its auth.json exists() check passes here
# AND the agent bind resolves on the host. `grok login` on the host. RO.
- ${ROBOCO_HOST_GROK_DIR:-${HOME}/.grok}:${ROBOCO_HOST_GROK_DIR:-${HOME}/.grok}:ro
# AND the agent bind resolves on the host. Read-WRITE: the orchestrator
# auto-refreshes the ~6h token in place (grok_auth.refresh_if_stale) so
# agents never mount a dead credential; the agent's own mount stays RO.
- ${ROBOCO_HOST_GROK_DIR:-${HOME}/.grok}:${ROBOCO_HOST_GROK_DIR:-${HOME}/.grok}
- ${ROBOCO_DATA_DIR:-./data}/mcp-configs:/app/mcp-configs
- ${ROBOCO_DATA_DIR:-./data}/prompts-generated:/app/prompts-generated
- ${ROBOCO_DATA_DIR:-./data}/agent-settings:/app/agent-settings