fix(deck): direct kiosk launcher + strip single-quoted Infisical values

[mabry1985]

Two bugs found during the first live Deck bring-up.

• protopen-kiosk.sh — the file:// "starting…" splash polled the backend with fetch(), but Chromium blocks file://→http:// fetches, so it never advanced and stranded the kiosk on the splash (looked like "won't load / stale file"). Replaced with a bash curl wait-loop that opens Chromium directly at the app (curl has no CORS issue; the backend is usually already up via the lingering unit).
• protopen-runtime-run.sh — Infisical's dotenv export single-quotes its values, but the quote-strip sed only handled double quotes. So --with-infisical injected OPENAI_API_KEY='sk-…' (with the quotes) and the gateway 401'd. Added a single-quote strip pass.

shellcheck + bash -n clean. Both already deployed and validated live on the Deck.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Refactor

  • Kiosk startup process now waits for backend readiness before launching the application, replacing the browser-based splash page approach for improved reliability.

• Bug Fixes

  • Enhanced environment variable configuration parsing to properly handle single-quoted values from external environment management tools, ensuring reliable configuration loading.

[protoquinn]

👀 Quinn is reviewing — verdict (PASS / WARN / FAIL) + findings to follow.

[coderabbitai]

Caution

Review failed

Pull request was closed or merged during review

Walkthrough

protopen-kiosk.sh replaces the HTML splash-file approach (which polled the backend from the browser and redirected) with a bash curl retry loop that waits for the backend before launching Chromium directly via --app="$URL". protopen-runtime-run.sh updates a sed pattern to strip single-quoted dotenv values (KEY='value') emitted by infisical.

Changes

Kiosk and Runtime Shell Script Changes

Layer / File(s)	Summary
Kiosk backend readiness loop and Chromium launch deck/protopen-kiosk.sh	Removes the temporary HTML splash file and browser-side polling redirect. Adds a bash while loop that probes $URL with curl (per-attempt timeout, sleep on failure, bounded by a retry cap), then launches flatpak run org.chromium.Chromium directly at --app="$URL" after ensuring the profile directory exists.
Runtime env-file single-quote stripping fix deck/protopen-runtime-run.sh	Replaces the sed -i pattern to now match KEY='value' assignments (single-quoted form emitted by infisical) and rewrite them to unquoted KEY=value in the generated env-file.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Suggested reviewers

• protoquinn

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The pull request title directly and accurately summarizes the two main changes: fixing the kiosk launcher to directly start Chromium and stripping single-quoted values from Infisical secrets.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/deck-kiosk-and-infisical

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[protoquinn]

QA Audit — PR #277 | fix(deck): direct kiosk launcher + strip single-quoted Infisical values

VERDICT: WARN (CI non-terminal — formal verdict deferred)

---

CI Status

• Verify workspace config: queued
• Lint: in_progress

Diff Review

• protopen-kiosk.sh: Replaces the file:// splash + fetch() approach with a curl wait-loop, then opens Chromium directly at the app. Fixes the file://→http:// CORS block that stranded the kiosk on the splash.
• protopen-runtime-run.sh: Adds a sed pass to strip single-quoted Infisical values (KEY='val' → KEY=val), fixing 401s from quoted API keys injected via --with-infisical.

Observations

• LOW: CI non-terminal (Verify workspace config queued, Lint in_progress). Code changes look correct; formal PASS/FAIL deferred until checks settle.
• Note: curl loop grants up to ~10 min of wait (150 × ~4s per cycle); generous but safe for cold Deck image pulls. Falls through to Chromium regardless, matching the old hard-cap behavior.
• Shell escaping on the new sed looks correct — double-quote outer quoting with \$ for the regex anchor.

— Quinn, QA Engineer

[protoquinn]

Submitted COMMENT review on #277.

[protoquinn]

CI terminal-green, no blockers on prior review — auto-approving on green (#748).