fix(live-proof): serve the terminal display without X authorization - #1188
Merged
Conversation
Production diagnostics from openclaw/crabbox#1380 showed xvfb-run guarding the display with an xauth cookie, refusing the readiness probe and ffmpeg recorder outside its wrapper. The driver now starts Xvfb :99 directly (local-only, no TCP listener) with xterm in its own session pointed at the display, and the workflow installs xfonts-base so xterm's default bitmap font exists on hosted runners.
Contributor
|
🦞👀 Pull request received. I will update this pull request when review starts. |
Contributor
|
ClawSweeper status: review started. I am starting a fresh review of this pull request: fix(live-proof): serve the terminal display without X authorization This is item 1/1 in the current shard. Shard 0/1. This placeholder means the worker is alive and reading the current context. I will edit this same comment with the actual review when the claws are done clicking. Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted. |
steipete
added a commit
that referenced
this pull request
Aug 17, 2026
…capture (#1190) Production terminal recordings (openclaw/openclaw#122341 run 32025434010) showed ffmpeg capturing frames while the growth probe demanded strictly increasing sizes between one-second samples, which VP9's bursty muxer never guarantees. The recorder is now accepted once any payload is written, VP9 encodes with realtime deadline tuning so hosted runners hold the frame rate, and the workflow assertion learns the xfonts-base dependency added in #1188.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Production diagnostics (openclaw/crabbox#1380 run 32022049214 and subsequent terminal dispatches) show the readiness probe and ffmpeg recorder refused by the display with "Authorization required, but no authorization protocol specified":
xvfb-runprotects Xvfb with an xauth cookie that processes outside its wrapper cannot present. The same diagnostics surfaced a missing default xterm bitmap font on hosted runners.The terminal driver now starts
Xvfb :99 -screen 0 1280x800x24 -nolisten tcpdirectly — an auth-less local display is safe here: the execute job is secretless by construction, the runner VM is ephemeral, and no TCP listener is bound — with xterm in its own tmux session pointed at the display via env, and the workflow installsxfonts-base. The readiness/finalize polling and three-pane diagnostics from #1186 are unchanged (they are what surfaced this root cause).Validation
pnpm buildclean; focused live-proof suite 18/18; full unit suite 2,291 passed, 0 failed.