arch: baudbot CLI dispatcher, systemd unit, and doctor command#22
Merged
Conversation
- bin/baudbot: bash dispatcher routing subcommands to internal scripts (start, stop, restart, status, logs, setup, config, deploy, audit, test, update, uninstall, doctor) - bin/baudbot.service: systemd unit with ExecStartPre hooks for harden-permissions and redact-logs, security hardening directives - bin/doctor.sh: health check covering user, deps, secrets, runtime, security, and agent status - setup.sh: installs CLI symlink (/usr/local/bin/baudbot) and systemd unit - uninstall.sh: removes CLI symlink and systemd unit - install.sh: launch via systemd when available, updated final output to reference baudbot commands - CI: verify baudbot CLI installed and working - package.json: add version field (0.1.0)
![sentry[bot]](https://avatars.githubusercontent.com/in/12637?s=60&v=4){kind=small}
Comment on lines
+417
to
+422
| systemctl start baudbot 2>/dev/null || true | ||
| sleep 2 | ||
| if systemctl is-active baudbot &>/dev/null 2>&1; then | ||
| info "Agent is running ✓" | ||
| else | ||
| warn "Agent didn't start — check: baudbot logs" |
There was a problem hiding this comment.
Bug: The setup.sh script lacks set -e, so it doesn't propagate failures from deploy.sh. This causes install.sh to attempt to start a service with missing files, masking the error.
Severity: HIGH
Suggested Fix
Add set -euo pipefail to the beginning of setup.sh to ensure that any errors from scripts it calls, such as deploy.sh, are properly propagated, causing the installation process to fail immediately and clearly.
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.
Location: install.sh#L417-L422
Potential issue: The `setup.sh` script, which is called by `install.sh`, does not have
`set -e` or `set -euo pipefail` enabled. Consequently, if the `deploy.sh` script fails
during its execution, the error is not propagated. `setup.sh` continues to run and exits
successfully. `install.sh` then proceeds to start the `baudbot` service, which will fail
because the necessary files, like `start.sh`, were not deployed. This service start
failure is then silently ignored by a `|| true` clause, masking the root cause of the
installation failure.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Phase 1 of the CLI restructure (TODO-41e29e4e). Adds a single
baudbotentry point that routes to internal scripts. No path changes yet — everything still works the old way internally.New files
bin/baudbot— CLI dispatcherBash script installed as
/usr/local/bin/baudbot. Routes subcommands:Resolves
BAUDBOT_ROOTfrom script location orBAUDBOT_ROOTenv var. Works whether symlinked from/usr/local/bin/or run directly from the repo.bin/baudbot.service— systemd unitIncludes security hardening: NoNewPrivileges, ProtectSystem=strict, ProtectHome=tmpfs, PrivateTmp, ReadOnlyPaths=/opt/baudbot.
bin/doctor.sh— health checkChecks: user exists, Node/pi/varlock installed, .env perms and contents, runtime deployed, firewall active, /proc hidepid, safe-bash installed, tool-guard read-only, systemd unit status.
Modified files
baudbotcommandsbaudbot --versionandbaudbot --helpwork after installversion: "0.1.0"