fix: make stateless launcher authentication optional - #65
Conversation
|
Warning Review limit reached
Next review available in: 44 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (12)
Summary by CodeRabbit
WalkthroughThe launcher now uses optional inline password configuration instead of a password secret. Insecure web access is enabled by default. Compose validation checks separate launcher and Codex authentication settings. ChangesLauncher authentication
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@compose/truenas.yml`:
- Around line 18-19: Update the TrueNAS Compose environment block to forward
WEB_USERNAME, map WEB_PASSWORD from LAUNCHER_PASSWORD with an empty default, and
derive ALLOW_INSECURE_WEB from LAUNCHER_ALLOW_INSECURE_WEB with the existing
insecure default. Add a rendered-config test covering the authenticated TrueNAS
override, including the documented password variable taking effect.
In `@scripts/test_single_stack_compose.py`:
- Around line 177-190: Update validate to enforce topology safety for both
launcher and Codex services: reject each service when network_mode equals
"host", and inspect every mount source to reject Docker or Podman socket paths.
Add deterministic assertions covering both services’ socket access and
privilege-escalation settings, preserving the existing launcher and Codex
environment checks.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 44512cc0-37b9-4b24-83ce-f2b565e50730
📒 Files selected for processing (4)
.env.examplecompose/docker-compose.ymlcompose/truenas.ymlscripts/test_single_stack_compose.py
📜 Review details
⏰ Context from checks skipped due to timeout. (1)
- GitHub Check: build
🧰 Additional context used
📓 Path-based instructions (2)
compose/**
⚙️ CodeRabbit configuration file
compose/**: Review Docker Compose files for TrueNAS and generic Docker compatibility.
Flag privileged mode, host networking, Docker socket mounts, overly broad host mounts,
missing authentication, unsafe public bindings and persistence paths that could lose credentials or workspaces.
Require launcher and agent services to reference one image while keeping agent state out of the launcher.
Files:
compose/truenas.ymlcompose/docker-compose.yml
scripts/test_single_stack_compose.py
⚙️ CodeRabbit configuration file
scripts/test_single_stack_compose.py: Check that topology assertions are deterministic and really prove one image reference, fixed roles,
no launcher access to agent state, no Docker socket/privilege escalation and preserved Codex compatibility.
Files:
scripts/test_single_stack_compose.py
🪛 dotenv-linter (4.0.0)
.env.example
[warning] 11-11: [UnorderedKey] The LAUNCHER_BASE_PATH key should go before the LAUNCHER_PUBLISH_IP key
(UnorderedKey)
[warning] 13-13: [UnorderedKey] The LAUNCHER_PASSWORD key should go before the LAUNCHER_PUBLISH_IP key
(UnorderedKey)
[warning] 14-14: [UnorderedKey] The LAUNCHER_CHECK_ORIGIN key should go before the LAUNCHER_PASSWORD key
(UnorderedKey)
[warning] 15-15: [UnorderedKey] The LAUNCHER_ALLOW_INSECURE_WEB key should go before the LAUNCHER_BASE_PATH key
(UnorderedKey)
🪛 Ruff (0.16.0)
scripts/test_single_stack_compose.py
[error] 275-275: Possible hardcoded password assigned to: "WEB_PASSWORD"
(S105)
🔇 Additional comments (3)
.env.example (1)
7-15: LGTM!compose/docker-compose.yml (1)
19-21: LGTM!scripts/test_single_stack_compose.py (1)
29-30: LGTM!Also applies to: 209-215, 245-290
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 457e4dbd0e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e1e9d0fce1
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: df55d01c6d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review Please review the exact final head |
|
@codex review Please perform the final review on exact head |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 66f2d08f55
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
1 participant
What changed
no-new-privilegesenabled;compose/launcher-auth.ymloverride;.env.example, structural Compose tests and the repository/issue contracts.Why
The implemented launcher is navigation only: it does not proxy terminal traffic, mount agent state, receive an agent password by default, or expose a privileged operation. Requiring a second Basic-auth challenge added friction without protecting the actual Codex endpoint, which already authenticates independently.
Security boundary
no-new-privilegesand mount separation remain enforced;Validation
ALLOW_INSECURE_WEB=0;