feat: export DEVA_AUTH_TAG for in-container account identity - #497
Conversation
- generate_auth_tag() ran only inside the container-name rewrite branch; hoist it and export the result as DEVA_AUTH_TAG on every run - credentials files carry no identity (tokens rotate), so the runner is the only party that knows which account a container talks as - first consumer: claude-code-statusline account chip + per-account cache scoping (the shared ~/.claude/statusline caches bleed across accounts when containers overlay different credentials on one home) - container naming and deva.auth_tag label unchanged Close #496 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
Claude encountered an error after 1s —— View job I'll analyze this and get back to you. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 83db928c41
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| # carries no identity (tokens rotate) — the tag is the only stable handle | ||
| # for WHICH account this container runs as. claude-code-statusline keys | ||
| # its per-account cache scoping and account chip on it. | ||
| DOCKER_ARGS+=(-e "DEVA_AUTH_TAG=${_auth_tag}") |
There was a problem hiding this comment.
When a persistent container was created before this version, adding DEVA_AUTH_TAG only to DOCKER_ARGS does not expose it to the launched agent: the attach path skips docker run and invokes docker exec with only the trace override. Upgraded users therefore continue without the tag—and the intended per-account cache isolation—until they manually delete and recreate every persistent container; pass the computed tag as an exec-time environment override as well.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Pull request overview
This PR exposes Deva’s existing “auth tag” (already used for container naming and the deva.auth_tag Docker label) inside every launched container as DEVA_AUTH_TAG, enabling in-container tooling to reliably distinguish which account/session identity a container is running under (e.g., for multi-account --auth-with runs).
Changes:
- Hoists
generate_auth_tag(...)so it’s computed once and reused for container naming anddeva.auth_taglabeling. - Exports the computed tag into the container environment as
DEVA_AUTH_TAGviaDOCKER_ARGS. - Documents the new environment variable in
CHANGELOG.mdand records the rationale inDEV-LOGS.md.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
deva.sh |
Computes auth tag once and injects it into containers as DEVA_AUTH_TAG, while keeping naming/label behavior consistent. |
DEV-LOGS.md |
Adds a dev log entry explaining the multi-account motivation and expected impact (#496). |
CHANGELOG.md |
Notes the new DEVA_AUTH_TAG container environment variable under Unreleased. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Export the auth tag deva already computes for container naming
(auth-default | auth-file- | api-key- | env) as
DEVA_AUTH_TAG env in every container.
Why: multi-account runs (--auth-with a.credentials.json vs
b.credentials.json) are indistinguishable from inside. The credentials
file holds no identity (tokens rotate) — the runner is the only party
that knows which account a container talks as. First consumer:
claude-code-statusline account chip + per-account cache scoping.
Close #496
🤖 Generated with Claude Code