fix: harden live smoke preflights

Author: steipete

CHANGELOG.md

@@ -42,6 +42,8 @@
 ### Fixed
 
 - Fixed code-scanning findings in container command execution, Worker sanitizers, docs link/build helpers, and JSON error responses.
+- Fixed live smoke scripts so provider-specific missing workflow, snapshot, CLI, Python client, or Semaphore config prerequisites fail before allocating resources, and added Sprites coverage to the live provider smoke.
+- Fixed live coordinator auth smoke so GitHub-authenticated coordinator identities are accepted and Cloudflare Access credential gaps print an actionable prerequisite error.
 - Fixed raw SSH-provider JS package command failures so Crabbox probes obvious `pnpm`, `npm`, `node`, `corepack`, `yarn`, and `bun` entrypoints before syncing and fails with hydration/setup guidance instead of an empty `exit 127` tail.
 - Fixed `crabbox webvnc --open` so opened portal links make the lease visible to authenticated org users instead of showing a misleading 404 when CLI auth and browser auth differ.
 - Fixed WebVNC portal click forwarding so controller clicks reach the remote desktop while preserving focus and browser context-menu suppression.

README.md

@@ -440,9 +440,9 @@ npm run build --prefix worker
 npm run docs:check
 
 # Optional live smoke, when broker/provider credentials are available
-CRABBOX_LIVE=1 CRABBOX_LIVE_REPO=/path/to/openclaw scripts/live-smoke.sh
+CRABBOX_LIVE=1 CRABBOX_LIVE_REPO=/path/to/my-app scripts/live-smoke.sh
 # Add Blacksmith only for repos with a Testbox workflow.
-CRABBOX_LIVE=1 CRABBOX_LIVE_PROVIDERS=blacksmith-testbox scripts/live-smoke.sh
+CRABBOX_LIVE=1 CRABBOX_LIVE_PROVIDERS=blacksmith-testbox CRABBOX_BLACKSMITH_WORKFLOW=.github/workflows/testbox.yml scripts/live-smoke.sh
 # Cloudflare Containers deploy plus live smoke, when Cloudflare credentials are available.
 scripts/deploy-cloudflare-smoke.sh
 ```

docs/operations.md

@@ -36,28 +36,33 @@ bin/crabbox history --limit 5
 When broker/provider credentials are available and infra changed, run the live smoke:
 
 ```sh
-CRABBOX_LIVE=1 CRABBOX_LIVE_REPO=/path/to/openclaw scripts/live-smoke.sh
+CRABBOX_LIVE=1 CRABBOX_LIVE_REPO=/path/to/my-app scripts/live-smoke.sh
 ```
 
 To narrow the live matrix while debugging, set `CRABBOX_LIVE_PROVIDERS`:
 
 ```sh
-CRABBOX_LIVE=1 CRABBOX_LIVE_PROVIDERS=aws CRABBOX_LIVE_REPO=/path/to/openclaw scripts/live-smoke.sh
-CRABBOX_LIVE=1 CRABBOX_LIVE_PROVIDERS=hetzner CRABBOX_LIVE_REPO=/path/to/openclaw scripts/live-smoke.sh
-CRABBOX_LIVE=1 CRABBOX_LIVE_PROVIDERS=blacksmith-testbox CRABBOX_LIVE_REPO=/path/to/openclaw scripts/live-smoke.sh
-CRABBOX_LIVE=1 CRABBOX_LIVE_PROVIDERS=e2b CRABBOX_LIVE_REPO=/path/to/openclaw scripts/live-smoke.sh
-CRABBOX_LIVE=1 CRABBOX_LIVE_PROVIDERS=modal CRABBOX_LIVE_REPO=/path/to/openclaw scripts/live-smoke.sh
-CRABBOX_LIVE=1 CRABBOX_LIVE_PROVIDERS=daytona CRABBOX_LIVE_REPO=/path/to/openclaw scripts/live-smoke.sh
-CRABBOX_LIVE=1 CRABBOX_LIVE_PROVIDERS=namespace-devbox CRABBOX_LIVE_REPO=/path/to/openclaw scripts/live-smoke.sh
-CRABBOX_LIVE=1 CRABBOX_LIVE_PROVIDERS=semaphore CRABBOX_LIVE_REPO=/path/to/openclaw scripts/live-smoke.sh
+CRABBOX_LIVE=1 CRABBOX_LIVE_PROVIDERS=aws CRABBOX_LIVE_REPO=/path/to/my-app scripts/live-smoke.sh
+CRABBOX_LIVE=1 CRABBOX_LIVE_PROVIDERS=hetzner CRABBOX_LIVE_REPO=/path/to/my-app scripts/live-smoke.sh
+CRABBOX_LIVE=1 CRABBOX_LIVE_PROVIDERS=blacksmith-testbox CRABBOX_LIVE_REPO=/path/to/my-app scripts/live-smoke.sh
+CRABBOX_LIVE=1 CRABBOX_LIVE_PROVIDERS=e2b CRABBOX_LIVE_REPO=/path/to/my-app scripts/live-smoke.sh
+CRABBOX_LIVE=1 CRABBOX_LIVE_PROVIDERS=modal CRABBOX_LIVE_REPO=/path/to/my-app scripts/live-smoke.sh
+CRABBOX_LIVE=1 CRABBOX_LIVE_PROVIDERS=daytona CRABBOX_LIVE_REPO=/path/to/my-app scripts/live-smoke.sh
+CRABBOX_LIVE=1 CRABBOX_LIVE_PROVIDERS=namespace-devbox CRABBOX_LIVE_REPO=/path/to/my-app scripts/live-smoke.sh
+CRABBOX_LIVE=1 CRABBOX_LIVE_PROVIDERS=semaphore CRABBOX_LIVE_REPO=/path/to/my-app scripts/live-smoke.sh
+CRABBOX_LIVE=1 CRABBOX_LIVE_PROVIDERS=sprites CRABBOX_LIVE_REPO=/path/to/my-app scripts/live-smoke.sh
 ```
 
-E2B smoke requires `E2B_API_KEY`. Modal smoke requires an authenticated Modal
-Python client (`python3 -m modal setup` or Modal token env vars). Semaphore smoke requires
-`CRABBOX_SEMAPHORE_HOST`, `CRABBOX_SEMAPHORE_PROJECT`, and
-`CRABBOX_SEMAPHORE_TOKEN` or equivalent user config.
-Daytona needs `CRABBOX_DAYTONA_SNAPSHOT` or `daytona.snapshot`.
-Namespace needs the authenticated `devbox` CLI on `PATH`.
+Blacksmith smoke requires a workflow containing a `useblacksmith/testbox`,
+`useblacksmith/begin-testbox`, or `useblacksmith/run-testbox` step; set
+`CRABBOX_BLACKSMITH_WORKFLOW` when the default path is not correct. E2B smoke
+requires `E2B_API_KEY`. Modal smoke requires an authenticated Modal Python
+client (`python3 -m modal setup` or Modal token env vars). Semaphore smoke
+requires `CRABBOX_SEMAPHORE_HOST`, `CRABBOX_SEMAPHORE_PROJECT`, and
+`CRABBOX_SEMAPHORE_TOKEN` or equivalent user config. Daytona needs
+`CRABBOX_DAYTONA_SNAPSHOT`, `DAYTONA_SNAPSHOT`, or `daytona.snapshot`.
+Namespace needs the authenticated `devbox` CLI on `PATH`. Sprites needs the
+authenticated `sprite` CLI on `PATH` plus a Sprites token in the environment.
 
 For direct-provider smoke, disable the coordinator with a scratch config and run the same commands manually:
 
@@ -97,7 +102,7 @@ health checks for `crabbox.openclaw.ai` plus the workers.dev fallback. To includ
 a short AWS lease smoke after deploy:
 
 ```sh
-CRABBOX_DEPLOY_SMOKE_AWS=1 CRABBOX_LIVE_REPO=/path/to/openclaw scripts/deploy-worker-smoke.sh
+CRABBOX_DEPLOY_SMOKE_AWS=1 CRABBOX_LIVE_REPO=/path/to/my-app scripts/deploy-worker-smoke.sh
 ```
 
 Required Worker secrets:

scripts/live-auth-smoke.sh

@@ -9,7 +9,25 @@ fi
 root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 cb="${CRABBOX_BIN:-$root/bin/crabbox}"
 coord="${CRABBOX_AUTH_SMOKE_COORDINATOR:-${CRABBOX_COORDINATOR:-https://crabbox-access.openclaw.ai}}"
-config_path="$("$cb" config path)"
+config_cwd="$PWD"
+config_paths=()
+
+add_config_path() {
+  local path="$1"
+  [[ -n "$path" ]] || return 0
+  if [[ "$path" != /* ]]; then
+    path="$config_cwd/$path"
+  fi
+  config_paths+=("$path")
+}
+
+if [[ -n "${CRABBOX_CONFIG:-}" ]]; then
+  add_config_path "$CRABBOX_CONFIG"
+else
+  add_config_path "$("$cb" config path 2>/dev/null || true)"
+  add_config_path "$config_cwd/crabbox.yaml"
+  add_config_path "$config_cwd/.crabbox.yaml"
+fi
 
 need_tool() {
   if ! command -v "$1" >/dev/null 2>&1; then
@@ -24,13 +42,36 @@ need_tool ruby
 
 config_value() {
   local key_path="$1"
-  ruby -ryaml -e '
-    value = ARGV[1].split(".").reduce(YAML.load_file(ARGV[0])) do |memo, key|
-      memo.is_a?(Hash) ? memo[key] : nil
-    end
-    exit 3 if value.nil? || value.to_s.empty?
-    print value
-  ' "$config_path" "$key_path"
+  local value=""
+  local found=0
+  local path
+  for path in "${config_paths[@]}"; do
+    [[ -r "$path" ]] || continue
+    if value="$(ruby -ryaml -e '
+      value = ARGV[1].split(".").reduce(YAML.load_file(ARGV[0])) do |memo, key|
+        memo.is_a?(Hash) ? memo[key] : nil
+      end
+      exit 3 if value.nil? || value.to_s.empty?
+      print value
+    ' "$path" "$key_path" 2>/dev/null)"; then
+      found=1
+    fi
+  done
+  if [[ "$found" == "1" ]]; then
+    printf '%s' "$value"
+    return 0
+  fi
+  return 1
+}
+
+required_config_value() {
+  local key_path="$1"
+  local value
+  if ! value="$(config_value "$key_path" 2>/dev/null)"; then
+    echo "missing required config: $key_path" >&2
+    exit 2
+  fi
+  printf '%s' "$value"
 }
 
 curl_quote() {
@@ -82,8 +123,8 @@ request_json() {
   printf '%s' "$status"
 }
 
-shared_token="$(config_value broker.token)"
-admin_token="$(config_value broker.adminToken)"
+shared_token="$(required_config_value broker.token)"
+admin_token="$(required_config_value broker.adminToken)"
 access_client_id="${CRABBOX_ACCESS_CLIENT_ID:-$(config_value broker.access.clientId 2>/dev/null || true)}"
 access_client_secret="${CRABBOX_ACCESS_CLIENT_SECRET:-$(config_value broker.access.clientSecret 2>/dev/null || true)}"
 owner="${CRABBOX_OWNER:-$(git config user.email 2>/dev/null || true)}"
@@ -97,11 +138,22 @@ if [[ "$coord" == *"crabbox-access.openclaw.ai"* ]]; then
     exit 1
   fi
   echo "ok no-access edge denied http=403"
+  if [[ -z "$access_client_id" || -z "$access_client_secret" ]]; then
+    echo "access auth smoke requires CRABBOX_ACCESS_CLIENT_ID/CRABBOX_ACCESS_CLIENT_SECRET or broker.access.clientId/clientSecret for $coord" >&2
+    exit 2
+  fi
 fi
 
-whoami="$(env -u CRABBOX_COORDINATOR_TOKEN CRABBOX_COORDINATOR="$coord" "$cb" whoami --json)"
-printf '%s\n' "$whoami" | jq -e '.auth == "bearer" and (.owner | length > 0) and (.org | length > 0)' >/dev/null
-echo "ok shared token whoami owner=$(printf '%s\n' "$whoami" | jq -r '.owner') org=$(printf '%s\n' "$whoami" | jq -r '.org')"
+if ! whoami="$(env -u CRABBOX_COORDINATOR_TOKEN CRABBOX_COORDINATOR="$coord" "$cb" whoami --json 2>&1)"; then
+  echo "failed coordinator whoami: $whoami" >&2
+  exit 1
+fi
+if ! printf '%s\n' "$whoami" | jq -e '(.auth == "bearer" or .auth == "github") and (.owner | length > 0) and (.org | length > 0)' >/dev/null; then
+  echo "failed coordinator whoami shape: $whoami" >&2
+  exit 1
+fi
+whoami_auth="$(printf '%s\n' "$whoami" | jq -r '.auth')"
+echo "ok coordinator whoami auth=$whoami_auth owner=$(printf '%s\n' "$whoami" | jq -r '.owner') org=$(printf '%s\n' "$whoami" | jq -r '.org')"
 
 body="$(mktemp)"
 trap 'rm -f "$body"' EXIT