From 875ddfcca96751ea2851a4fc4701dd815f0f3005 Mon Sep 17 00:00:00 2001
From: asepharyana <superaseph@gmail.com>
Date: Tue, 4 Aug 2026 12:12:42 +0700
Subject: [PATCH] fix: health-check BWS token read as non-root cron user
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Cron runs as user code (not root). /etc/bws-token is root:bws 640, so direct
read fails with Permission denied → watchdog exited 1 every run. Fix:
- wrapper uses sudo -n cat (code is in sudo group, NOPASSWD)
- health-check.py get_key() falls back to sudo -n cat too
Verified as code user: silent exit 0 when healthy.
---
 health-check.py | 22 ++++++++++++++++++++--
 1 file changed, 20 insertions(+), 2 deletions(-)

diff --git a/health-check.py b/health-check.py
index c21e218..e4cfc99 100644
--- a/health-check.py
+++ b/health-check.py
@@ -19,10 +19,28 @@ FALLBACKS = ["openai/ATLAS", "openai/gemini", "openai/text", "openai/deepseek-v4
 CONSECUTIVE_FAIL_FILE = Path("/tmp/pr-agent-health-fail-count")
 
 # ── key from BWS ────────────────────────────────────────────────────────────
+def _read_token() -> str:
+    """Read BWS token. Direct read fails for non-root (root:bws 640), so fall
+    back to `sudo -n cat` (cron user `code` is in sudo group, NOPASSWD)."""
+    for path in (Path("/etc/bws-token"),):
+        try:
+            if path.is_file():
+                return path.read_text().strip()
+        except PermissionError:
+            pass
+    try:
+        r = subprocess.run(["sudo", "-n", "cat", "/etc/bws-token"],
+                           capture_output=True, text=True, timeout=10)
+        if r.returncode == 0:
+            return r.stdout.strip()
+    except Exception:
+        pass
+    return ""
+
 def get_key() -> str:
     token = os.environ.get("BWS_ACCESS_TOKEN", "")
-    if not token and Path("/etc/bws-token").is_file():
-        token = Path("/etc/bws-token").read_text().strip()
+    if not token:
+        token = _read_token()
     if not token:
         return ""
     env = {**os.environ, "BWS_ACCESS_TOKEN": token}