{"record":{"id":"b65e0e091a61c681","repo":"can1357/oh-my-pi","slug":"robomp-orchestrator-refuses-to-start-with-github-t-b65e0e","errorCode":null,"errorMessage":"robomp orchestrator refuses to start with GITHUB_TOKEN set in env. The PAT must live only in the gh-proxy container.","messagePattern":"robomp orchestrator refuses to start with GITHUB_TOKEN set in env\\. The PAT must live only in the gh-proxy container\\.","errorType":"exception","errorClass":"SystemExit","httpStatus":null,"severity":"critical","filePath":"python/robomp/src/server.py","lineNumber":238,"sourceCode":"                \"author\": s.author,\n                \"labels\": list(s.labels),\n                \"comments\": s.comments,\n                \"updated_at\": s.updated_at,\n                \"created_at\": s.created_at,\n                \"html_url\": s.html_url,\n                \"processed\": make_issue_key(s.repo, s.number) in processed_keys,\n            }\n            for s in entry.issues\n        ],\n        \"errors\": [dict(error) for error in entry.errors],\n        \"repos\": list(entry.repos),\n        \"cache\": {\"hit\": cache_hit, \"fetched_at\": entry.fetched_at},\n    }\n\n\ndef _require_proxy_mode(cfg: Settings) -> tuple[str, bytes]:\n    if cfg.github_token is not None:\n        raise SystemExit(\n            \"robomp orchestrator refuses to start with GITHUB_TOKEN set in env. \"\n            \"The PAT must live only in the gh-proxy container.\"\n        )\n    if cfg.gh_proxy_url is None or cfg.gh_proxy_hmac_key is None:\n        raise SystemExit(\n            \"robomp orchestrator requires ROBOMP_GH_PROXY_URL and \"\n            \"ROBOMP_GH_PROXY_HMAC_KEY (run gh-proxy in a sibling container).\"\n        )\n    return cfg.gh_proxy_url, cfg.gh_proxy_hmac_key.get_secret_value().encode(\"utf-8\")\n\n\ndef _build_orchestrator(cfg: Settings) -> tuple[GitHubBackend, ProxyGitTransport]:\n    base_url, key = _require_proxy_mode(cfg)\n    github = GitHubProxyClient(base_url=base_url, hmac_key=key)\n    transport = ProxyGitTransport(base_url=base_url, hmac_key=key)\n    return github, transport\n\n","sourceCodeStart":220,"sourceCodeEnd":256,"githubUrl":"https://github.com/can1357/oh-my-pi/blob/969062200754ea02cfac922e5ebb8c608c079e15/python/robomp/src/server.py#L220-L256","documentation":"Before building the orchestrator, _require_proxy_mode() refuses startup (SystemExit) if GITHUB_TOKEN is set. Robomp's security model is that the PAT exists only inside the gh-proxy sidecar container; a token in the orchestrator env means GitHub credentials could leak into agent-visible processes.","triggerScenarios":"Starting `robomp serve` (via _build_orchestrator → _require_proxy_mode) with GITHUB_TOKEN (or ROBOMP-parsed github_token) present in the environment while gh-proxy mode is the intended configuration.","commonSituations":"Leftover GITHUB_TOKEN exported in shell or .env from another tool; GITHUB_TOKEN present in the base container image; compose `environment:` passing GITHUB_TOKEN through; switching from single-process PAT mode to gh-proxy mode without removing the old var.","solutions":["Unset GITHUB_TOKEN in the orchestrator environment (.env, shell profile, compose environment: block) and restart.","Configure gh-proxy mode instead: set ROBOMP_GH_PROXY_URL and ROBOMP_GH_PROXY_HMAC_KEY; keep the PAT only in the gh-proxy container.","Check the Docker image/compose file for baked-in GITHUB_TOKEN and remove it.","If you truly want PAT mode, run in the supported single-process PAT mode without the proxy vars — but the bundled deployment expects proxy mode."],"exampleFix":"// before (.env)\nGITHUB_TOKEN=ghp_xxx\nROBOMP_GH_PROXY_URL=http://gh-proxy:8080\n// after (.env)\n# GITHUB_TOKEN removed — PAT lives only in the gh-proxy container\nROBOMP_GH_PROXY_URL=http://gh-proxy:8080\nROBOMP_GH_PROXY_HMAC_KEY=<shared-secret>","handlingStrategy":"validation","validationCode":"import os\nif os.environ.get('GITHUB_TOKEN'):\n    raise SystemExit('Unset GITHUB_TOKEN before starting robomp in gh-proxy mode')","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep GITHUB_TOKEN out of .env, shell profiles, and compose environment: for the orchestrator service","Use a dedicated .env for gh-proxy mode copied from .env.example","Audit the container image for baked-in tokens"],"tags":["configuration","security","environment","startup"],"backgroundTag":"missing-env-var","analyzedSha":"969062200754ea02cfac922e5ebb8c608c079e15","analyzedAt":"2026-08-31T10:29:35.737Z","schemaVersion":2},"datasetVersion":"2026-08-31T14:17:45.589Z"}