Skip to content

Fix varlock path compatibility for debug/startup/subagents #203

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
benvinegar merged 2 commits into from
Mar 17, 2026
Merged

Fix varlock path compatibility for debug/startup/subagents #203

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
4aaabe2
runtime: support varlock binary path compatibility
benvinegar Mar 17, 2026
d666663
varlock: address review nits for telemetry check and symlink safety
benvinegar Mar 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion bin/baudbot.service
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ Restart=on-failure
RestartSec=10

# Environment
Environment=PATH=/home/baudbot_agent/.varlock/bin:/home/baudbot_agent/opt/node/bin:/usr/local/bin:/usr/bin:/bin
Environment=PATH=/home/baudbot_agent/.varlock/bin:/home/baudbot_agent/.config/varlock/bin:/home/baudbot_agent/opt/node/bin:/usr/local/bin:/usr/bin:/bin
Environment=HOME=/home/baudbot_agent

# Security hardening
Expand Down
6 changes: 3 additions & 3 deletions bin/ci/setup-arch.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -77,10 +77,10 @@ echo "$CLI_TARGET" | grep -qE '^/opt/baudbot/releases/.+/bin/baudbot$'
baudbot --version
HELP_OUT=$(baudbot --help)
echo "$HELP_OUT" | grep -q "baudbot"
# varlock installed for agent user
test -x /home/baudbot_agent/.varlock/bin/varlock
# varlock installed for agent user (supports both legacy and current install paths)
test -x /home/baudbot_agent/.varlock/bin/varlock || test -x /home/baudbot_agent/.config/varlock/bin/varlock
# Agent can load env (smoke test — varlock validates schema + .env)
sudo -u baudbot_agent bash -c 'export PATH="$HOME/.varlock/bin:$HOME/opt/node/bin:$PATH" && cd ~ && varlock load --path ~/.config/'
sudo -u baudbot_agent bash -c 'export PATH="$HOME/.varlock/bin:$HOME/.config/varlock/bin:$HOME/opt/node/bin:$PATH" && cd ~ && varlock load --path ~/.config/'
echo " ✓ bootstrap + install verification passed"

echo "=== Running CLI smoke checks ==="
Expand Down
6 changes: 3 additions & 3 deletions bin/ci/setup-ubuntu.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -96,10 +96,10 @@ echo "$CLI_TARGET" | grep -qE '^/opt/baudbot/releases/.+/bin/baudbot$'
baudbot --version
HELP_OUT=$(baudbot --help)
echo "$HELP_OUT" | grep -q "baudbot"
# varlock installed for agent user
test -x /home/baudbot_agent/.varlock/bin/varlock
# varlock installed for agent user (supports both legacy and current install paths)
test -x /home/baudbot_agent/.varlock/bin/varlock || test -x /home/baudbot_agent/.config/varlock/bin/varlock
# Agent can load env (smoke test — varlock validates schema + .env)
sudo -u baudbot_agent bash -c 'export PATH="$HOME/.varlock/bin:$HOME/opt/node/bin:$PATH" && cd ~ && varlock load --path ~/.config/'
sudo -u baudbot_agent bash -c 'export PATH="$HOME/.varlock/bin:$HOME/.config/varlock/bin:$HOME/opt/node/bin:$PATH" && cd ~ && varlock load --path ~/.config/'
echo " ✓ bootstrap + install verification passed"

echo "=== Running CLI smoke checks ==="
Expand Down
4 changes: 3 additions & 1 deletion bin/doctor.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,10 +80,12 @@ if [ -n "${BAUDBOT_ROOT:-}" ] && command -v rg &>/dev/null; then
fi
fi

if command -v varlock &>/dev/null || [ -x "$BAUDBOT_HOME/.varlock/bin/varlock" ]; then
if command -v varlock &>/dev/null || [ -x "$BAUDBOT_HOME/.varlock/bin/varlock" ] || [ -x "$BAUDBOT_HOME/.config/varlock/bin/varlock" ]; then
pass "varlock is installed"
if [ -f "$BAUDBOT_HOME/.varlock/config.json" ] && grep -q '"anonymousId"' "$BAUDBOT_HOME/.varlock/config.json"; then
warn "$BAUDBOT_HOME/.varlock/config.json includes anonymousId (export VARLOCK_TELEMETRY_DISABLED=1 or remove this field)"
elif [ -f "$BAUDBOT_HOME/.config/varlock/config.json" ] && grep -q '"anonymousId"' "$BAUDBOT_HOME/.config/varlock/config.json"; then
warn "$BAUDBOT_HOME/.config/varlock/config.json includes anonymousId (export VARLOCK_TELEMETRY_DISABLED=1 or remove this field)"
Comment on lines 85 to +89
Copy link
Copy Markdown

@greptile-apps greptile-apps Bot Mar 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 elif silences telemetry warning for new config path when legacy config also matches

Because the new config-path check is behind an elif, if ~/.varlock/config.json exists and contains anonymousId, the check for ~/.config/varlock/config.json is never reached — even if that file also contains anonymousId. On systems where both config files are present (e.g., migrated installs), the new-path telemetry issue would go undetected.

Use two independent if blocks so both paths are always checked:

Suggested change
if [ -f "$BAUDBOT_HOME/.varlock/config.json" ] && grep -q '"anonymousId"' "$BAUDBOT_HOME/.varlock/config.json"; then
warn "$BAUDBOT_HOME/.varlock/config.json includes anonymousId (export VARLOCK_TELEMETRY_DISABLED=1 or remove this field)"
elif [ -f "$BAUDBOT_HOME/.config/varlock/config.json" ] && grep -q '"anonymousId"' "$BAUDBOT_HOME/.config/varlock/config.json"; then
warn "$BAUDBOT_HOME/.config/varlock/config.json includes anonymousId (export VARLOCK_TELEMETRY_DISABLED=1 or remove this field)"
if [ -f "$BAUDBOT_HOME/.varlock/config.json" ] && grep -q '"anonymousId"' "$BAUDBOT_HOME/.varlock/config.json"; then
warn "$BAUDBOT_HOME/.varlock/config.json includes anonymousId (export VARLOCK_TELEMETRY_DISABLED=1 or remove this field)"
fi
if [ -f "$BAUDBOT_HOME/.config/varlock/config.json" ] && grep -q '"anonymousId"' "$BAUDBOT_HOME/.config/varlock/config.json"; then
warn "$BAUDBOT_HOME/.config/varlock/config.json includes anonymousId (export VARLOCK_TELEMETRY_DISABLED=1 or remove this field)"
fi
Prompt To Fix With AI 
This is a comment left during a code review.
Path: bin/doctor.sh
Line: 85-88

Comment:
**`elif` silences telemetry warning for new config path when legacy config also matches**

Because the new config-path check is behind an `elif`, if `~/.varlock/config.json` exists **and** contains `anonymousId`, the check for `~/.config/varlock/config.json` is never reached — even if that file also contains `anonymousId`. On systems where both config files are present (e.g., migrated installs), the new-path telemetry issue would go undetected.

Use two independent `if` blocks so both paths are always checked:

```suggestion
  if [ -f "$BAUDBOT_HOME/.varlock/config.json" ] && grep -q '"anonymousId"' "$BAUDBOT_HOME/.varlock/config.json"; then
    warn "$BAUDBOT_HOME/.varlock/config.json includes anonymousId (export VARLOCK_TELEMETRY_DISABLED=1 or remove this field)"
  fi
  if [ -f "$BAUDBOT_HOME/.config/varlock/config.json" ] && grep -q '"anonymousId"' "$BAUDBOT_HOME/.config/varlock/config.json"; then
    warn "$BAUDBOT_HOME/.config/varlock/config.json includes anonymousId (export VARLOCK_TELEMETRY_DISABLED=1 or remove this field)"
  fi
```

How can I resolve this? If you propose a fix, please make it concise.

Copy link
Copy Markdown
Member Author

@benvinegar benvinegar Mar 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch. Fixed in d666663.

I changed the telemetry checks in bin/doctor.sh to use two independent if blocks, so both legacy (~/.varlock/config.json) and current (~/.config/varlock/config.json) paths are checked even when both exist.

Responded by baudbot-dev-agent using openai/gpt-5.

fi
else
fail "varlock not found"
Expand Down
2 changes: 1 addition & 1 deletion bin/lib/baudbot-runtime.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -519,7 +519,7 @@ cmd_debug() {

exec sudo -u "$AGENT_USER" bash -lc "
unset PKG_EXECPATH
export PATH='$AGENT_HOME/.varlock/bin:$node_bin_dir':\$PATH
export PATH='$AGENT_HOME/.varlock/bin:$AGENT_HOME/.config/varlock/bin:$node_bin_dir':\$PATH
export VARLOCK_TELEMETRY_DISABLED=1
cd ~
varlock run --path ~/.config/ -- pi \
Expand Down
2 changes: 1 addition & 1 deletion bin/subagents.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -283,7 +283,7 @@ spawn_one() {
sudo -u "$AGENT_USER" mkdir -p "$AGENT_HOME/.pi/agent/logs"

local tmux_cmd
tmux_cmd="cd $(shell_quote "$cwd") && export PATH=\"\$HOME/.varlock/bin:\$HOME/opt/node/bin:\$PATH\" && export PI_SESSION_NAME=$(shell_quote "$session_name") && exec varlock run --path \"\$HOME/.config/\" -- pi --session-control --skill $(shell_quote "$skill_path") --model $(shell_quote "$model") > $(shell_quote "$log_path") 2>&1"
tmux_cmd="cd $(shell_quote "$cwd") && export PATH=\"\$HOME/.varlock/bin:\$HOME/.config/varlock/bin:\$HOME/opt/node/bin:\$PATH\" && export PI_SESSION_NAME=$(shell_quote "$session_name") && exec varlock run --path \"\$HOME/.config/\" -- pi --session-control --skill $(shell_quote "$skill_path") --model $(shell_quote "$model") > $(shell_quote "$log_path") 2>&1"
sudo -u "$AGENT_USER" tmux new-session -d -s "$session_name" "$tmux_cmd"

local alias_path="$CONTROL_DIR/$ready_alias.alias"
Expand Down
9 changes: 8 additions & 1 deletion setup.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -252,12 +252,19 @@ echo "=== Installing varlock ==="
# varlock must be available to the agent user (start.sh adds ~/.varlock/bin to PATH).
# Install as agent user so it lands in the right home directory.
AGENT_VARLOCK="$BAUDBOT_HOME/.varlock/bin/varlock"
if [ -x "$AGENT_VARLOCK" ]; then
AGENT_VARLOCK_CONFIG_BIN="$BAUDBOT_HOME/.config/varlock/bin/varlock"
if [ -x "$AGENT_VARLOCK" ] || [ -x "$AGENT_VARLOCK_CONFIG_BIN" ]; then
echo "varlock already installed for baudbot_agent, skipping"
else
sudo -u baudbot_agent bash -c 'curl -sSfL https://varlock.dev/install.sh | sh -s'
fi

# Newer varlock installers place the binary under ~/.config/varlock/bin.
# Keep a compatibility link at ~/.varlock/bin/varlock for existing runtime scripts.
if [ -x "$AGENT_VARLOCK_CONFIG_BIN" ]; then
sudo -u baudbot_agent bash -c "mkdir -p '$BAUDBOT_HOME/.varlock/bin' && ln -sf '$AGENT_VARLOCK_CONFIG_BIN' '$AGENT_VARLOCK'"
Copy link
Copy Markdown

@greptile-apps greptile-apps Bot Mar 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 ln -sf silently overwrites a real binary when both install locations coexist

If ~/.varlock/bin/varlock already exists as a real (non-symlink) binary — e.g., a legacy install — and ~/.config/varlock/bin/varlock also exists, ln -sf will silently delete the real binary and replace it with a symlink. While the symlink points to an equally valid binary, this is a destructive and potentially surprising operation on re-runs of setup.sh.

Consider guarding with a check that skips the symlink creation if the legacy path already contains a functional binary that is not a symlink:

if [ -x "$AGENT_VARLOCK_CONFIG_BIN" ] && [ ! -x "$AGENT_VARLOCK" ]; then
  sudo -u baudbot_agent bash -c "mkdir -p '$BAUDBOT_HOME/.varlock/bin' && ln -sf '$AGENT_VARLOCK_CONFIG_BIN' '$AGENT_VARLOCK'"
fi

This creates the compatibility link only when the legacy path is absent, avoiding accidental replacement of an existing real binary.

Prompt To Fix With AI 
This is a comment left during a code review.
Path: setup.sh
Line: 264-265

Comment:
**`ln -sf` silently overwrites a real binary when both install locations coexist**

If `~/.varlock/bin/varlock` already exists as a real (non-symlink) binary — e.g., a legacy install — and `~/.config/varlock/bin/varlock` also exists, `ln -sf` will silently delete the real binary and replace it with a symlink. While the symlink points to an equally valid binary, this is a destructive and potentially surprising operation on re-runs of `setup.sh`.

Consider guarding with a check that skips the symlink creation if the legacy path already contains a functional binary that is not a symlink:

```bash
if [ -x "$AGENT_VARLOCK_CONFIG_BIN" ] && [ ! -x "$AGENT_VARLOCK" ]; then
  sudo -u baudbot_agent bash -c "mkdir -p '$BAUDBOT_HOME/.varlock/bin' && ln -sf '$AGENT_VARLOCK_CONFIG_BIN' '$AGENT_VARLOCK'"
fi
```

This creates the compatibility link only when the legacy path is absent, avoiding accidental replacement of an existing real binary.

How can I resolve this? If you propose a fix, please make it concise.

Copy link
Copy Markdown
Member Author

@benvinegar benvinegar Mar 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good point. Fixed in d666663.

setup.sh now preserves an existing real legacy binary at ~/.varlock/bin/varlock and only creates/updates the compatibility symlink when the legacy path is absent or already a symlink.

Responded by baudbot-dev-agent using openai/gpt-5.

fi

echo "=== Publishing initial git-free /opt release ==="
# Build an immutable release snapshot from the local source checkout, then deploy
# from /opt/baudbot/releases/<sha>. This keeps live operations decoupled from
Expand Down
4 changes: 2 additions & 2 deletions start.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,8 +18,8 @@ cd ~

NODE_BIN_DIR="$(bb_resolve_runtime_node_bin_dir "$HOME")"

# Set PATH
export PATH="$HOME/.varlock/bin:$NODE_BIN_DIR:$PATH"
# Set PATH (varlock may be installed in ~/.varlock/bin or ~/.config/varlock/bin)
export PATH="$HOME/.varlock/bin:$HOME/.config/varlock/bin:$NODE_BIN_DIR:$PATH"

# Work around varlock telemetry config crash by opting out at runtime.
export VARLOCK_TELEMETRY_DISABLED=1
Expand Down
Loading