Fase 2: 04_sanitize.py - scrubbing de secretos de skills/agentes/plans (10 secretos unicos, gate en verde)

2026-07-29 00:35:59 +00:00
parent 21bc219f31
commit 837f91060f
79 changed files with 10153 additions and 0 deletions
@@ -0,0 +1,57 @@
+# Plan: Hacer que .bashrc cargue variables de entorno en shells no interactivos
+
+## Context
+
+The `.bashrc` file has an early-exit guard at lines 5-9:
+
+```bash
+case $- in
+    *i*) ;;
+      *) return;;
+esac
+```
+
+This causes bash to skip the entire file when invoked in **non-interactive mode** (scripts, `bash -c "..."`, CI, Docker exec). All the `export` statements at the bottom of the file (PATH, JAVA_HOME, ANDROID_HOME, NVM, SDK, tokens) are therefore never loaded in non-interactive shells.
+
+The `.profile` sources `.bashrc`, but `.profile` is only read by login shells. So login shells get the exports (via `.profile` → `.bashrc`), but non-interactive shells do not.
+
+## Solution
+
+Move the environment variable exports **above** the interactive guard so they are always sourced, regardless of shell mode. Keep interactive-only content (aliases, prompt, history, completion) **below** the guard.
+
+### File to modify
+
+- `/home/aleleba/projects/aleleba-vscode-dockerfile-configuration/.bashrc` (also copied to `~/.bashrc` by entrypoint.sh)
+
+### Changes
+
+1. **Keep the guard at the top** — it stays, but only guards interactive-only content.
+2. **Move all `export` statements above the guard**:
+   - `export LS_COLORS=...`
+   - `export PATH=...` (includes Java, Android SDK, NVM paths)
+   - `export JAVA_HOME=...`
+   - `export ANDROID_HOME=...`
+   - `export ANDROID_SDK_ROOT=...`
+   - `export NVM_DIR=...` + `nvm.sh` source + `nvm use default`
+   - `export EMSDK_QUIET=...`
+   - `source /emsdk/emsdk_env.sh`
+   - `export PATH="$HOME/.local/bin:$PATH"`
+   - All token/credential exports (`GITEA_TOKEN`, `GMAIL_ADDRESS`, `NPM_TOKEN`, `SUPABASE_ACCESS_TOKEN`, etc.)
+3. **Keep everything else below the guard** (aliases, prompt, history, completion, dircolors, etc.) — these are interactive-only and should not run in scripts.
+4. **Keep `.profile` as-is** — it sources `.bashrc`, which will now correctly load exports even in login shells.
+
+### Result
+
+| Shell type | Exports loaded? | Aliases/prompt loaded? |
+|---|---|---|
+| Interactive login | Yes (via `.profile` → `.bashrc`) | Yes |
+| Interactive non-login | Yes (direct `.bashrc` source) | Yes |
+| Non-interactive (`bash -c`, scripts, CI) | **Yes** (exports are above guard) | No (correct) |
+
+### Verification
+
+1. `bash -c 'echo $JAVA_HOME $ANDROID_HOME $NVM_DIR'` — should print values
+2. `bash -c 'echo $GITEA_TOKEN'` — should print the token
+3. `bash -c 'alias ll'` — should fail (aliases not loaded in non-interactive, correct)
+4. `bash -i -c 'alias ll'` — should work (interactive still gets aliases)
+5. Build and run the Docker container, exec into it and check `printenv | grep -E 'JAVA|ANDROID|NVM|PATH'`