fix(examples): unbreak the 21 failing examples in the nightly matrix - #47
Merged
Merged
Conversation
Nightly cron run 33487941064 was green while 21 of 51 examples failed
(failures are advisory). Fixes the ones that are ours:
- 49/50/51: `.env.ant` is gitignored and never exists in CI, so the
loader threw ENOENT before doing anything. Read credentials from the
process env first (under ANTHROPIC_ORG_API_KEY, a distinct name so the
shared gateway's ANTHROPIC_API_KEY can never be mistaken for the
organization key), and treat the dotenv as an optional fallback.
- 41: MuPDF writes warnings to stdout, so `JSON.parse(stdout)` failed.
The extractor now writes JSON to a file the host downloads.
- 09: `npm install ... 2>&1` merged stderr into stdout, so the throw
reported an empty stderr. Drop the redirect, report both streams.
- 52: `resume()` returns before the sandbox has an IP; `files.download`
then 503s with "sandbox has no ip". Wait for running + an IP.
- workflows: wire ANCHOR_API_KEY / FIRECRAWL_API_KEY and the Managed
Agents credentials into the job env, and stop passing
S3_USE_PATH_STYLE as a secret — its value ("1") made GitHub mask
every "1" in every log line.
- 09: the devbox rootfs already ships the claude CLI, so `npm install -g` died with EEXIST (visible only after the previous commit stopped swallowing npm's stderr). Install only when the binary is absent. - 13: when the pause/resume demo timed out, the recovery path swallowed both the resume and the wait failure and queried a still-paused sandbox, surfacing as an opaque 409 "sandbox is paused; resume first". Retry resume until running, then fail with a clear message.
- 09: the rootfs ships `claude` outside /usr/local/bin, so the previous `command -v` guard skipped the install and the non-root task — which only sees /usr/local/bin — died with exit 127. Guard on the path. - 55: the desktop stack boots after the sandbox, so the first `computer.screen` call 409s with `desktop_unavailable`. Retry until it answers, bounded at 120s.
The claude shim resolves node through `env`, but the rootfs keeps node under /root (mode 700), so dropping to sandboxuser produced a bare exit 127. Copy node onto /usr/local/bin, and stop merging stderr into stdout so a future failure reports something.
`claude` on PATH is an asdf shim that re-execs `asdf`, and the asdf tree lives under /root (mode 700) — so once the example drops to a non-root user (required by --dangerously-skip-permissions) the shim died with a bare 127. Open /root for traversal only and link the real binary.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The nightly example matrix reported success while 21 of its 51 examples
failed — example failures are advisory, so nothing turned the run red.
Run 33487941064
was the starting point; this branch takes it from 21 failures to 4.
Root causes and fixes
400 failed to get config for provider deepseek: not found. The gateway's only configured provider isopenrouter, and the model secrets nameddeepseek/deepseek-v4-pro— so bifrost read the first path segment as a provider it does not have.OPENAI_MODEL/ANTHROPIC_MODEL/LLM_MODELnow carry theopenrouter/prefix. No code change..env.antis gitignored and never exists in CI, so the loader threwENOENTbefore doing anything.ANTHROPIC_ORG_API_KEY— a distinct name, because in CIANTHROPIC_API_KEYis the gateway key and Managed Agents talks toapi.anthropic.comdirectly.JSON.parse(stdout)failed — MuPDF writes warnings to stdout.npm install … 2>&1merged stderr into stdout, so the throw reported an empty stderr. Underneath: the rootfs shipsclaudeas an asdf shim that re-execsasdf, and the asdf tree lives under/root(mode 700) — invisible to the non-root user--dangerously-skip-permissionsrequires, giving a bare127./rootfor traversal (+x, not+r), and invoke the real binary. Errors now report both streams.resume()returns before the sandbox has an IP;files.downloadthen 503s withsandbox has no ip.computer.screencall 409s withdesktop_unavailable.409 sandbox is paused; resume first.1made GitHub mask every1in every log line (bun install v***.4.0).S3_USE_PATH_STYLEis a plain literal in the workflows now; it was never sensitive.Both workflows also gained
ANCHOR_API_KEY,FIRECRAWL_API_KEYand theManaged Agents credentials in
env:.Verification
Full matrix on this branch:
33600552945 — 4 failures left, none of them a code defect:
against
api.anthropic.com:401 {"type":"authentication_error","message":"API key is invalid."}.Needs a fresh key, not a code change.
node-startexited 1 with empty stdout and stderr, ~36sin; passed in the two preceding runs. Node-boot flake.
Known gap, not addressed here: example 09 is green but returns empty output,
because Claude Code does not recognize
openrouter/deepseek/deepseek-v4-proand skips the work. Pointing
ANTHROPIC_MODELat a recognized id fixes it.