{"record":{"id":"bc5f74c5b5a12c5f","repo":"can1357/oh-my-pi","slug":"robomp-orchestrator-refuses-to-start-with-github-t","errorCode":null,"errorMessage":"robomp orchestrator refuses to start with GITHUB_TOKEN set in env. The PAT must live only in the gh-proxy container.","messagePattern":"robomp orchestrator refuses to start with GITHUB_TOKEN set in env\\. The PAT must live only in the gh-proxy container\\.","errorType":"validation","errorClass":"SystemExit","httpStatus":null,"severity":"error","filePath":"python/robomp/src/cli.py","lineNumber":38,"sourceCode":"    enqueue_manual_triage,\n    parse_issue_ref,\n)\nfrom robomp.proxy_client import GitHubProxyClient\nfrom robomp.sandbox import SandboxManager\nfrom robomp.server import create_app\n\n\ndef _settings_or_die() -> Settings:\n    try:\n        return get_settings()\n    except Exception as exc:\n        click.echo(f\"configuration error: {exc}\", err=True)\n        sys.exit(2)\n\n\ndef _require_proxy_mode(cfg: Settings) -> tuple[str, bytes]:\n    if cfg.github_token is not None:\n        raise SystemExit(\n            \"robomp orchestrator refuses to start with GITHUB_TOKEN set in env. \"\n            \"The PAT must live only in the gh-proxy container.\"\n        )\n    if cfg.gh_proxy_url is None or cfg.gh_proxy_hmac_key is None:\n        raise SystemExit(\n            \"robomp orchestrator requires ROBOMP_GH_PROXY_URL and \"\n            \"ROBOMP_GH_PROXY_HMAC_KEY (run gh-proxy in a sibling container).\"\n        )\n    return cfg.gh_proxy_url, cfg.gh_proxy_hmac_key.get_secret_value().encode(\"utf-8\")\n\n\ndef _build_github(cfg: Settings) -> GitHubProxyClient:\n    base_url, key = _require_proxy_mode(cfg)\n    return GitHubProxyClient(base_url=base_url, hmac_key=key)\n\n\ndef _default_wait_timeout(cfg: Settings) -> float:\n    return cfg.task_timeout_seconds + cfg.task_timeout_hard_grace_seconds + 30.0","sourceCodeStart":20,"sourceCodeEnd":56,"githubUrl":"https://github.com/can1357/oh-my-pi/blob/969062200754ea02cfac922e5ebb8c608c079e15/python/robomp/src/cli.py#L20-L56","documentation":"robomp's orchestrator only talks to GitHub through the gh-proxy sidecar; _require_proxy_mode() aborts startup via SystemExit if a GITHUB_TOKEN is present, because the PAT is supposed to live exclusively inside the gh-proxy container. This is a deliberate security guard against token leakage into the orchestrator process.","triggerScenarios":"Starting the robomp orchestrator (via _build_github) with GITHUB_TOKEN (or ROBOMP_GITHUB_TOKEN) set in the environment while intending proxy mode.","commonSituations":"Leftover GITHUB_TOKEN in shell profile or CI environment; reusing a .env file from a direct-PAT deployment; container inheriting env vars from the host; mixing deployment modes during migration to gh-proxy.","solutions":["Unset GITHUB_TOKEN from the orchestrator's environment (unset, remove from .env, or drop from container env).","Move the PAT into the gh-proxy container's configuration only.","If you actually want direct-PAT mode, this CLI path is not it — check that you are running the intended deployment mode.","Restart the orchestrator and confirm with a dry run that the env no longer contains the token."],"exampleFix":"// before (.env for orchestrator)\nGITHUB_TOKEN=ghp_xxx\nROBOMP_GH_PROXY_URL=http://gh-proxy:8080\n// after (.env for orchestrator — token only in gh-proxy)\nROBOMP_GH_PROXY_URL=http://gh-proxy:8080\nROBOMP_GH_PROXY_HMAC_KEY=<key>","handlingStrategy":"validation","validationCode":"import os\nif \"GITHUB_TOKEN\" in os.environ and os.environ.get(\"ROBOMP_GH_PROXY_URL\"):\n    raise SystemExit(\"GITHUB_TOKEN must not be set when running the orchestrator in proxy mode\")","typeGuard":"def is_proxy_mode_env(env: dict) -> bool:\n    return bool(env.get(\"ROBOMP_GH_PROXY_URL\")) and bool(env.get(\"ROBOMP_GH_PROXY_HMAC_KEY\")) and not env.get(\"GITHUB_TOKEN\")","tryCatchPattern":null,"preventionTips":["Keep GITHUB_TOKEN only in the gh-proxy container's env/secret store.","Use separate .env files per deployment mode and load only the right one.","Strip inherited host env vars when launching the orchestrator container (env: clean).","Run a preflight env check in your deploy script before startup."],"tags":["python","configuration","security","env-var","github"],"backgroundTag":"invalid-environment-configuration","analyzedSha":"969062200754ea02cfac922e5ebb8c608c079e15","analyzedAt":"2026-08-31T10:29:35.737Z","schemaVersion":2},"datasetVersion":"2026-08-31T14:17:45.589Z"}