From 692a85248f7e6b607c871dffa07f21109a5c617f Mon Sep 17 00:00:00 2001 From: Proactive Runtime Bot Date: Thu, 30 Jul 2026 22:51:37 +0200 Subject: [PATCH] fix(verify): make Slack delivery work in the cloud sandbox Deploying the schedule surfaced two defects that only appear in the cloud environment, so no local run would have caught them. 1. The sandbox injects CLOUD_API_ACCESS_TOKEN, not CLOUD_API_TOKEN (see the env bundle in cloud's bootstrap/launcher.ts), but @relayflows/slack-primitive reads only CLOUD_API_TOKEN. Every scheduled run would have failed Slack delivery with auth_token_missing. github-primitive already falls back RELAY_CLOUD_API_TOKEN -> CLOUD_API_ACCESS_TOKEN; slack-primitive does not, so the workflow bridges it with the same precedence. 2. ENV_DEFAULTS assigned the cloud variables without exporting them, so the node child that posts to Slack saw only the original process env and the fallback above had no effect. CLOUD_API_URL and CLOUD_API_TOKEN are now exported. Defect 2 also means the earlier stub-server verification passed only because CLOUD_API_TOKEN was set directly in that test's environment; it would not have worked in the sandbox. Verified against a stub server for all three cases: ACCESS_TOKEN-only now posts with the right bearer, a directly-set CLOUD_API_TOKEN still posts, and neither configured still fails loudly with the payload echoed. Co-Authored-By: Claude Opus 5 --- workflows/audit-feature-manifest.ts | 17 +++++++++++++++++ workflows/verify-features.ts | 17 +++++++++++++++++ 2 files changed, 34 insertions(+) diff --git a/workflows/audit-feature-manifest.ts b/workflows/audit-feature-manifest.ts index be82db646..5e57d34f4 100644 --- a/workflows/audit-feature-manifest.ts +++ b/workflows/audit-feature-manifest.ts @@ -84,6 +84,23 @@ NIGHTCTO_EVIDENCE_URL="$(printenv NIGHTCTO_EVIDENCE_URL || true)" NIGHTCTO_EVIDENCE_TOKEN="$(printenv NIGHTCTO_EVIDENCE_TOKEN || true)" CLOUD_API_URL="$(printenv CLOUD_API_URL || true)" CLOUD_API_TOKEN="$(printenv CLOUD_API_TOKEN || true)" +# The cloud sandbox injects CLOUD_API_ACCESS_TOKEN, not CLOUD_API_TOKEN (see +# the launcher's env bundle), but @relayflows/slack-primitive only reads +# CLOUD_API_TOKEN. Without this bridge every scheduled run fails Slack +# delivery with auth_token_missing. github-primitive already falls back the +# same way (RELAY_CLOUD_API_TOKEN -> CLOUD_API_ACCESS_TOKEN); slack does not. +if [ -z "$CLOUD_API_TOKEN" ]; then + CLOUD_API_TOKEN="$(printenv RELAY_CLOUD_API_TOKEN || true)" +fi +if [ -z "$CLOUD_API_TOKEN" ]; then + CLOUD_API_TOKEN="$(printenv CLOUD_API_ACCESS_TOKEN || true)" +fi + +# These are read by the node children this workflow writes and runs (the Slack +# post script), so they must be exported, not just assigned. Plain assignment +# left the child seeing only the original process env, which silently defeated +# the fallback above. +export CLOUD_API_URL CLOUD_API_TOKEN RELAY_CLI="$(printenv RELAY_CLI || true)" VERIFY_ENVIRONMENT="$(printenv VERIFY_ENVIRONMENT || true)" if [ -z "$POSTHOG_HOST" ]; then POSTHOG_HOST="https://i.agentrelay.com"; fi diff --git a/workflows/verify-features.ts b/workflows/verify-features.ts index 6a75ec541..606f337cf 100644 --- a/workflows/verify-features.ts +++ b/workflows/verify-features.ts @@ -118,6 +118,23 @@ NIGHTCTO_EVIDENCE_URL="$(printenv NIGHTCTO_EVIDENCE_URL || true)" NIGHTCTO_EVIDENCE_TOKEN="$(printenv NIGHTCTO_EVIDENCE_TOKEN || true)" CLOUD_API_URL="$(printenv CLOUD_API_URL || true)" CLOUD_API_TOKEN="$(printenv CLOUD_API_TOKEN || true)" +# The cloud sandbox injects CLOUD_API_ACCESS_TOKEN, not CLOUD_API_TOKEN (see +# the launcher's env bundle), but @relayflows/slack-primitive only reads +# CLOUD_API_TOKEN. Without this bridge every scheduled run fails Slack +# delivery with auth_token_missing. github-primitive already falls back the +# same way (RELAY_CLOUD_API_TOKEN -> CLOUD_API_ACCESS_TOKEN); slack does not. +if [ -z "$CLOUD_API_TOKEN" ]; then + CLOUD_API_TOKEN="$(printenv RELAY_CLOUD_API_TOKEN || true)" +fi +if [ -z "$CLOUD_API_TOKEN" ]; then + CLOUD_API_TOKEN="$(printenv CLOUD_API_ACCESS_TOKEN || true)" +fi + +# These are read by the node children this workflow writes and runs (the Slack +# post script), so they must be exported, not just assigned. Plain assignment +# left the child seeing only the original process env, which silently defeated +# the fallback above. +export CLOUD_API_URL CLOUD_API_TOKEN VERIFY_ENVIRONMENT="$(printenv VERIFY_ENVIRONMENT || true)" if [ -z "$POSTHOG_HOST" ]; then POSTHOG_HOST="https://i.agentrelay.com"; fi if [ -z "$VERIFY_ENVIRONMENT" ]; then VERIFY_ENVIRONMENT="sandbox"; fi