can1357/oh-my-pi · error · SystemExit

robomp orchestrator refuses to start with GITHUB_TOKEN set i

Error message

robomp orchestrator refuses to start with GITHUB_TOKEN set in env. The PAT must live only in the gh-proxy container.

What it means

robomp's orchestrator only talks to GitHub through the gh-proxy sidecar; _require_proxy_mode() aborts startup via SystemExit if a GITHUB_TOKEN is present, because the PAT is supposed to live exclusively inside the gh-proxy container. This is a deliberate security guard against token leakage into the orchestrator process.

Source

Thrown at python/robomp/src/cli.py:38

    enqueue_manual_triage,
    parse_issue_ref,
)
from robomp.proxy_client import GitHubProxyClient
from robomp.sandbox import SandboxManager
from robomp.server import create_app


def _settings_or_die() -> Settings:
    try:
        return get_settings()
    except Exception as exc:
        click.echo(f"configuration error: {exc}", err=True)
        sys.exit(2)


def _require_proxy_mode(cfg: Settings) -> tuple[str, bytes]:
    if cfg.github_token is not None:
        raise SystemExit(
            "robomp orchestrator refuses to start with GITHUB_TOKEN set in env. "
            "The PAT must live only in the gh-proxy container."
        )
    if cfg.gh_proxy_url is None or cfg.gh_proxy_hmac_key is None:
        raise SystemExit(
            "robomp orchestrator requires ROBOMP_GH_PROXY_URL and "
            "ROBOMP_GH_PROXY_HMAC_KEY (run gh-proxy in a sibling container)."
        )
    return cfg.gh_proxy_url, cfg.gh_proxy_hmac_key.get_secret_value().encode("utf-8")


def _build_github(cfg: Settings) -> GitHubProxyClient:
    base_url, key = _require_proxy_mode(cfg)
    return GitHubProxyClient(base_url=base_url, hmac_key=key)


def _default_wait_timeout(cfg: Settings) -> float:
    return cfg.task_timeout_seconds + cfg.task_timeout_hard_grace_seconds + 30.0

View on GitHub (pinned to 9690622007)

Solutions

1. Unset GITHUB_TOKEN from the orchestrator's environment (unset, remove from .env, or drop from container env).
2. Move the PAT into the gh-proxy container's configuration only.
3. If you actually want direct-PAT mode, this CLI path is not it — check that you are running the intended deployment mode.
4. Restart the orchestrator and confirm with a dry run that the env no longer contains the token.

Example fix

// before (.env for orchestrator)
GITHUB_TOKEN=ghp_xxx
ROBOMP_GH_PROXY_URL=http://gh-proxy:8080
// after (.env for orchestrator — token only in gh-proxy)
ROBOMP_GH_PROXY_URL=http://gh-proxy:8080
ROBOMP_GH_PROXY_HMAC_KEY=<key>

import os
if "GITHUB_TOKEN" in os.environ and os.environ.get("ROBOMP_GH_PROXY_URL"):
    raise SystemExit("GITHUB_TOKEN must not be set when running the orchestrator in proxy mode")

def is_proxy_mode_env(env: dict) -> bool:
    return bool(env.get("ROBOMP_GH_PROXY_URL")) and bool(env.get("ROBOMP_GH_PROXY_HMAC_KEY")) and not env.get("GITHUB_TOKEN")

When it happens

Trigger: Starting the robomp orchestrator (via _build_github) with GITHUB_TOKEN (or ROBOMP_GITHUB_TOKEN) set in the environment while intending proxy mode.

Common situations: Leftover GITHUB_TOKEN in shell profile or CI environment; reusing a .env file from a direct-PAT deployment; container inheriting env vars from the host; mixing deployment modes during migration to gh-proxy.

Related errors

• robomp orchestrator requires ROBOMP_GH_PROXY_URL and ROBOMP_
• no GitHub access configured: set GITHUB_TOKEN, or set ROBOMP
• ROBOMP_BOT_LOGIN must be a non-empty GitHub login
• GITHUB_TOKEN and ROBOMP_GH_PROXY_URL are mutually exclusive
• ROBOMP_GH_PROXY_URL and ROBOMP_GH_PROXY_HMAC_KEY must both b

AI-assisted analysis of can1357/oh-my-pi@9690622007 (2026-08-31). Data as JSON: /api/errors/bc5f74c5b5a12c5f. Report an issue: GitHub.