Repository navigation
nextjs-ct agent-update: run claude update for every account every night - #703
Conversation
…ight The nightly job only ran the Claude installer when ~/.local/bin/claude was missing and left updates to Claude's own background updater. Every pool session runs under `claw-master connect`, which sets DISABLE_AUTOUPDATER=1 for the Claude it launches, so that updater never ran: on 2026-10-26 the job logged "2.1.294 -> 2.1.294" (and 2.1.295, 2.1.299, 2.1.302) in every container while 2.1.311 was out. - agent-update: for an account with a native copy, run `claude update` as the account with DISABLE_AUTOUPDATER removed from the environment, from its home, stdin closed; warn when it fails. An account without one still gets the installer. Versions are read from ~/.local/bin/claude directly instead of a login shell's `claude`. - The users file and the home root are overridable (AGENT_UPDATE_USERS, AGENT_UPDATE_HOMES) for the tests. - AgentUpdateTests in test-nextjs-ct-containers.py run the real script against a fake sudo, claude, curl and systemctl: an update to the latest, a failed update reported, the installer for a missing copy. All three fail on the old script.
…he tests fake it The tests ran the whole job as the real account, and its call to /usr/local/bin/kid-agents-refresh by absolute path bypassed the PATH fakes: on a container, that would rewrite the real account's ~/Documents/Codex/AGENTS.md. agent-update now runs $AGENT_UPDATE_REFRESH (default unchanged), and the tests give it a fake and check it is called for the account.
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 59 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
@codex review |
|
|
@codex security review |
|
Codex Review: Didn't find any major issues. 👍 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
🛡️ Codex Security ReviewSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
|
Reviewed Exact-head Terraform validation and offline CI passed, including 64 container tests and 35 Next.js configuration tests. Codex code and security reviews completed with no findings; all comments and review threads were checked. CodeRabbit was requested but is quota-limited, and Greptile has not responded; neither is counted as a sign-off. |
|
Merged and applied as 11a5bcc. The reviewed full plan changed only the published container updater script (0 add / 1 change / 0 destroy); apply succeeded and the full follow-up plan is empty. setup-sync completed successfully, and all five containers have the exact merged updater checksum. Host boot ID, container leaders, and all baseline Claude PIDs were preserved. No nightly updater was invoked manually. /infra/applied-status is clean for this commit. |
The nightly
agent-updatein each nextjs container never updated Claude Code. It ran the installer only when~/.local/bin/claudewas missing, and left updates to Claude's own background updater. But every pool session runs underclaw-master connect, which setsDISABLE_AUTOUPDATER=1for the Claude it launches, so that updater never ran. On 2026-10-26 the job logged2.1.294 -> 2.1.294(and 2.1.295, 2.1.299, 2.1.302) in every container while 2.1.311 was out.What changes
scripts/nextjs-ct/ct/agent-update:claude updateas the account, from its home, with stdin closed andDISABLE_AUTOUPDATERremoved from the environment. It warns when the update fails.~/.local/bin/claudedirectly.AGENT_UPDATE_USERS,AGENT_UPDATE_HOMES,AGENT_UPDATE_REFRESH). The defaults are unchanged.AgentUpdateTestsinscripts/test-nextjs-ct-containers.pyrun the real script against a fakesudo,claude,curl,systemctland refresh helper. They cover:All three fail on the old script.
Running sessions keep their binary. Each session's next start (t-claude, or the idle restarts the job already does) runs the new one.
Testing
lambda-tests.ymlpass.claude updateas each container account took every one to 2.1.311:Codex: reviewed
origin/main..42bed43(one P2, the test reaching the real refresh helper, fixed in debc615), then42bed43..debc615(no findings).