ai-workspace-lab/xworkspace-console
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore(macos): surface vault admin bootstrap error (temporary diagnostic)

Browse Source 
The bootstrap runs under no_log, hiding the real failure. Capture the script
result (keeping no_log so the password in the args stays censored), print only
stdout/stderr (no secrets), then assert. Lets the actual init_vault_admin.sh
error surface for diagnosis; to be removed once the root cause is fixed.
This commit is contained in:
Haitao Pan 2026-06-18 12:17:27 +00:00
parent 5750d3d2ae
commit c5c4ecf58a
1 changed files with 40 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

40
scripts/setup-ai-workspace-all-in-one.sh
View File

@ -1172,6 +1172,46 @@ boot_new = (
) )
if boot_old in tasks_text and boot_new not in tasks_text: if boot_old in tasks_text and boot_new not in tasks_text:
tasks_text = tasks_text.replace(boot_old, boot_new, 1) tasks_text = tasks_text.replace(boot_old, boot_new, 1)
# 2c) DIAGNOSTIC (macOS): the bootstrap runs under no_log so its real failure is
# hidden. Capture the result (keeping no_log on the script so the password in the
# command args stays censored) and print only stdout/stderr — which carry no
# secrets — then assert, so the actual error surfaces instead of a censored blob.
diag_anchor = (
" no_log: true\n"
" when:\n"
" - not ansible_check_mode\n"
)
diag_new = (
" no_log: true\n"
" register: vault_admin_bootstrap_result\n"
" failed_when: false\n"
" when:\n"
" - not ansible_check_mode\n"
)
if diag_anchor in tasks_text and "vault_admin_bootstrap_result" not in tasks_text:
tasks_text = tasks_text.replace(diag_anchor, diag_new, 1)
diag_tasks = (
"\n- name: Show Vault admin bootstrap diagnostics (macOS)\n"
" ansible.builtin.debug:\n"
" msg:\n"
" - \"rc={{ vault_admin_bootstrap_result.rc | default('n/a') }}\"\n"
" - \"stdout={{ vault_admin_bootstrap_result.stdout_lines | default([]) }}\"\n"
" - \"stderr={{ vault_admin_bootstrap_result.stderr_lines | default([]) }}\"\n"
" when:\n"
" - ansible_os_family == 'Darwin'\n"
" - vault_admin_bootstrap_result is defined\n"
"\n- name: Fail when Vault admin bootstrap failed (macOS)\n"
" ansible.builtin.assert:\n"
" that:\n"
" - (vault_admin_bootstrap_result.rc | default(1)) == 0\n"
" fail_msg: \"vault admin bootstrap failed; see diagnostics above\"\n"
" when:\n"
" - ansible_os_family == 'Darwin'\n"
" - vault_admin_bootstrap_result is defined\n"
)
if "Show Vault admin bootstrap diagnostics (macOS)" not in tasks_text:
tasks_text = tasks_text.rstrip("\n") + "\n" + diag_tasks
tasks_path.write_text(tasks_text) tasks_path.write_text(tasks_text)
# 3) Create the macOS vault dirs (user-owned) before the launchd plist is laid down. # 3) Create the macOS vault dirs (user-owned) before the launchd plist is laid down.