* fix(skill): fix 6 dogfood bugs in orca-per-workspace-env templates
Fixes found while standing up a local Docker SSH per-workspace env (§7h) end to end:
1. GIT_ASKPASS helper broke under set -u — the printf interpolated $1/$GH_TOKEN
at write-time, aborting the clone with "$1: unbound variable". Escape both so
they land literally and resolve at git-runtime (also keeps the token out of the
file); rm the helper after. (§5, §7f base-snapshot + create, §10)
2. Agent-auth verify missed stderr — 'codex login status' prints "Logged in" to
stderr, so the stdout-only grep wrongly reported not-logged-in. Fold 2>&1.
(§4, §7b, §7f Phase 3, §7h, §10)
3. --device-auth is mandatory on headless VMs — plain OAuth login binds an
unreachable loopback callback port and hangs. (§4, §7b, §7h, §10)
4. Interactive Phase-3 login can't be driven by a non-interactive orchestrator
(no TTY for docker exec -it / ssh -t) — user runs it themselves, or via the
harness bang-prefix. (§1, §4)
5. Local Docker host-key churn — ephemeral containers regenerating host keys churn
known_hosts on localhost as ports rotate; bake host keys into the base image at
build time. (§7h + validation notes, §10)
6. Orchestrator must ask the user to report back when the interactive login
finishes before resuming non-interactive phases. (§1, §4, §7b, §7h)
Co-authored-by: Orca <help@stably.ai>
* fix(skill): tighten login gate, de-dup gotchas in orca-per-workspace-env
- Verify login via exit code first; when grepping, match the agent's exact
success line, never `grep -qi 'logged in'` (also matches "not logged in")
- Keep the generic template agent-agnostic; hardcode codex strings only in
the codex-based Vercel worked example (now case-insensitive)
- Collapse repeated device-auth / stderr-fold / GIT_ASKPASS rationale to
§4/§5 cross-refs; add a load-bearing-escaping test note
- Add a connection-mode orientation block up front; fix front-matter grammar
Co-authored-by: Orca <help@stably.ai>
* docs(skill): replace 'orchestrator' jargon with plain no-TTY wording
The term meant 'the agent running these steps runs commands
non-interactively, so it has no TTY.' Say that directly instead, and
drop the redundant 'orchestrating agent'/'non-interactive orchestrator'
doubling at the Phase-3 checkpoint.
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Orca <help@stably.ai>
45370a5987