coilyco-flight-deck/infrastructure

Watch

ward exec forgejo-admin-token fails TTY check under the make/uv wrapper #579

New issue

Closed

opened 2026-07-22 08:59:43 +00:00 by coilyco-ops · 1 comment

coilyco-ops commented

2026-07-22 08:59:43 +00:00

Member

ward exec forgejo-admin-token refuses with "attended operator shell required" even in an attended interactive shell, because the make -> uv run subprocess chain does not preserve a TTY on stdin/stderr.

Symptom

Running ward exec forgejo-admin-token (or bash a script that calls it) in an interactive Warp session:

ward: exec forgejo-admin-token in .../infrastructure
forgejo-admin-token: attended operator shell required
make: *** [forgejo-admin-token] Error 1

Root cause

scripts/forgejo-admin-token.py gates on sys.stdin.isatty() and sys.stderr.isatty() to keep headless callers (timers, bulk sync) from pulling the site-admin PAT. But the invocation path is ward exec -> make forgejo-admin-token -> uv run python scripts/forgejo-admin-token.py, and that wrapper chain does not hand the child a TTY on stdin/stderr, so the attended check fails for a genuinely attended operator too.

Impact

Any operator flow that needs the admin/owner token has no working ward path. Concretely, the Forgejo/GitHub reconcile retire step (deleting repos, which the coilyco-ops read token cannot do - 403 "user should be the owner") cannot run through ward. The 22 retires in the first reconcile pass had to be done out of band (web UI) instead of through the tooling.

Possible fixes (not prescribing one)

Relax the check to sys.stdin.isatty() only. stdout is already a pipe by design (consumed via $(...)), and stderr is the one the wrapper reassigns, so stdin is the honest attended signal.
Or invoke the helper from make in a way that preserves the controlling TTY.
Or add an explicit env-gated attended override (e.g. FORGEJO_ADMIN_ATTENDED=1) for known-interactive operator shells.

Context

Surfaced by the Forgejo/GitHub reconcile report work (#578).

`ward exec forgejo-admin-token` refuses with "attended operator shell required" even in an attended interactive shell, because the make -> uv run subprocess chain does not preserve a TTY on stdin/stderr. ## Symptom Running `ward exec forgejo-admin-token` (or `bash` a script that calls it) in an interactive Warp session: ``` ward: exec forgejo-admin-token in .../infrastructure forgejo-admin-token: attended operator shell required make: *** [forgejo-admin-token] Error 1 ``` ## Root cause `scripts/forgejo-admin-token.py` gates on `sys.stdin.isatty() and sys.stderr.isatty()` to keep headless callers (timers, bulk sync) from pulling the site-admin PAT. But the invocation path is `ward exec` -> `make forgejo-admin-token` -> `uv run python scripts/forgejo-admin-token.py`, and that wrapper chain does not hand the child a TTY on stdin/stderr, so the attended check fails for a genuinely attended operator too. ## Impact Any operator flow that needs the admin/owner token has no working ward path. Concretely, the Forgejo/GitHub reconcile retire step (deleting repos, which the coilyco-ops read token cannot do - 403 "user should be the owner") cannot run through ward. The 22 retires in the first reconcile pass had to be done out of band (web UI) instead of through the tooling. ## Possible fixes (not prescribing one) - Relax the check to `sys.stdin.isatty()` only. stdout is already a pipe by design (consumed via $(...)), and stderr is the one the wrapper reassigns, so stdin is the honest attended signal. - Or invoke the helper from make in a way that preserves the controlling TTY. - Or add an explicit env-gated attended override (e.g. FORGEJO_ADMIN_ATTENDED=1) for known-interactive operator shells. ## Context Surfaced by the Forgejo/GitHub reconcile report work (#578).

coilyco-ops added the

autonomy

live-collab

priority

labels

2026-07-29 03:46:21 +00:00

coilyco-ops added the

role/platform

role/sysadmin

labels

2026-08-25 08:02:27 +00:00

coilyco-ops commented

2026-08-27 03:09:28 +00:00

Author

Member

Closed in the 2026-08-26 backlog burn-down (coilyco-bridge/agentic-os-kai#901).

Verified as already landed: Closing: the TTY gate is gone. Commit 4cdbb21 removed scripts/forgejo-admin-token.py and the ward exec forgejo-admin-token verb entirely, moving the twelve call sites to read the SSM SecureString directly, so there is no attended-shell check left to fail under the make/uv wrapper.

This issue was open only because nothing closed it when the work shipped. If the verification is wrong, reopen it. The whole set is recoverable with state:closed label:burndown-2026-08.

Closed in the 2026-08-26 backlog burn-down (coilyco-bridge/agentic-os-kai#901). Verified as already landed: Closing: the TTY gate is gone. Commit 4cdbb21 removed scripts/forgejo-admin-token.py and the `ward exec forgejo-admin-token` verb entirely, moving the twelve call sites to read the SSM SecureString directly, so there is no attended-shell check left to fail under the make/uv wrapper. This issue was open only because nothing closed it when the work shipped. If the verification is wrong, reopen it. The whole set is recoverable with `state:closed label:burndown-2026-08`.

coilyco-ops

2026-08-27 03:09:29 +00:00

closed this issue
added the
burndown-2026-08
label

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

coilyco-flight-deck/infrastructure#579

No description provided.

Rows
Columns