mirror of
https://github.com/alexbelgium/hassio-addons.git
synced 2026-09-20 16:53:59 +02:00
da50d9b178
* fix(claude_desktop): persist sign-in by opting into Electron safeStorage Claude Desktop asked the user to sign in again on every start. The v1.35 fix was inert: --password-store=basic did reach the process (confirmed on a live install's /proc/<pid>/cmdline), but the app still logged "safeStorage not available, tokens will not persist" on every launch. Electron refuses its built-in basic_text backend unless the application calls safeStorage.setUsePlainTextEncryption(true) before the ready event, and Claude Desktop never calls it - the symbol is present in the shipped Electron binary but absent from resources/app.asar. So isEncryptionAvailable() stayed false and the auth token was never persisted. Verified against a standalone Electron of the same generation: without the opt-in it is false; with it, true, and a separate later process decrypts a blob written by an earlier one. There is no equivalent command-line switch, and NODE_OPTIONS=--require is ignored by packaged Electron apps (verified against the real binary), so the opt-in is injected into the app's main bundle inside app.asar. gnome-keyring stays out of the image: its first-boot password prompt blocks the app from launching at all. The patcher fails closed, rebuilds the archive preserving unpacked/symlink entries, recomputes the changed entry's SHA-256 integrity record, and fully re-validates the result from disk before renaming it into place. It re-runs on every boot after 81-claude_update.sh, since an apt upgrade ships a fresh unpatched app.asar, and is marker-guarded so an unchanged app is a no-op. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(claude_desktop): harden the safeStorage hook against review findings - Sweep stale .app.asar.addon-tmp.* from the shell hook. `timeout` kills the patcher outright, so a run that hits the 120s cap never executes its own cleanup; the live archive stays unpatched, so every later boot would retry under a new pid and strand another archive-sized file. - End the hook with an explicit `exit 0`. The logging `while` loop's status became the script's status, so an empty last line could exit non-zero and fail cont-init - the opposite of the documented "never block startup". Both raised in review on #2922. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
24 lines
1.6 KiB
Bash
24 lines
1.6 KiB
Bash
#!/usr/bin/env sh
|
|
# Persist Claude Desktop sign-in across restarts.
|
|
# Claude Desktop (Electron) stores its auth token via safeStorage. On Linux the libsecret
|
|
# backend needs a running Secret Service (gnome-keyring), but gnome-keyring is intentionally
|
|
# not installed in this image: on first boot it prompts for a keyring password, which blocks
|
|
# Claude Desktop from ever launching. Without the daemon, forcing --password-store=gnome-libsecret
|
|
# leaves safeStorage.isEncryptionAvailable()=false, so the session can never be stored — that
|
|
# surfaced as recurring "sign in again" prompts and (because the stale session also fails the
|
|
# elevated-access OAuth check) the Claude app's dispatch tab showing this desktop as offline.
|
|
#
|
|
# --password-store=basic uses Electron's built-in fixed-key store instead: no daemon and no
|
|
# prompt. Secrets land under $HOME/.config/Claude, and HOME=/data/data is persistent add-on
|
|
# storage, so the saved sign-in survives restarts.
|
|
#
|
|
# This flag is only half of it. Electron refuses the basic backend unless the application opts
|
|
# in via safeStorage.setUsePlainTextEncryption(true), and Claude Desktop never calls it — with
|
|
# the flag alone, isEncryptionAvailable() stays false and the sign-in is still lost on every
|
|
# restart. /etc/cont-init.d/86-claude_safestorage.sh injects that opt-in into app.asar before
|
|
# this runs; do not drop one without the other.
|
|
# Headroom is intentionally not injected into the Desktop process: Claude Desktop
|
|
# force-overrides ANTHROPIC_BASE_URL (headroom #869), so Desktop uses the registered Headroom
|
|
# MCP tools instead.
|
|
exec claude-desktop --no-sandbox --disable-dev-shm-usage --password-store=basic
|