update report h6

packages/casan-harness/scripts/bash/local-full.sh

@@ -22,6 +22,85 @@ AUTH_BRIDGE_AUDIT="$AUTH_BRIDGE_DIR/model-audit.jsonl"
 AUTH_BRIDGE="$ROOT/packages/casan-control-panel/scripts/provider-auth-bridge.py"
 CMD="${1:-status}"
 
+resolve_python() {
+  if [[ -n "${CASAN_PYTHON_BIN:-}" ]]; then
+    if command -v "$CASAN_PYTHON_BIN" >/dev/null 2>&1 && "$CASAN_PYTHON_BIN" --version >/dev/null 2>&1; then
+      printf '%s\n' "$CASAN_PYTHON_BIN"
+      return 0
+    fi
+    echo "CASAN_LOCAL_PYTHON_INVALID path=$CASAN_PYTHON_BIN" >&2
+    return 1
+  fi
+
+  # Prefer macOS' universal system Python over stale framework installs that may
+  # appear first in PATH but are terminated by Gatekeeper/Rosetta on Apple Silicon.
+  local candidate
+  for candidate in /usr/bin/python3 python3 python; do
+    if command -v "$candidate" >/dev/null 2>&1 && "$candidate" --version >/dev/null 2>&1; then
+      printf '%s\n' "$candidate"
+      return 0
+    fi
+  done
+  echo "CASAN_LOCAL_PYTHON_MISSING" >&2
+  return 1
+}
+
+prepare_docker_cli() {
+  local original_config="${DOCKER_CONFIG:-$HOME/.docker}"
+  local config_file="$original_config/config.json"
+  [[ -f "$config_file" ]] || return 0
+
+  local python_bin credential_store helper context_name docker_host fallback_config
+  python_bin="$(resolve_python)" || return 1
+  credential_store="$("$python_bin" - "$config_file" <<'PY'
+import json
+import sys
+
+try:
+    with open(sys.argv[1], encoding="utf-8") as handle:
+        print(json.load(handle).get("credsStore", ""))
+except (OSError, ValueError):
+    print("")
+PY
+)"
+  [[ -n "$credential_store" ]] || return 0
+
+  helper="$(command -v "docker-credential-$credential_store" 2>/dev/null || true)"
+  if [[ -n "$helper" ]] && "$python_bin" - "$helper" <<'PY' >/dev/null 2>&1
+import subprocess
+import sys
+
+raise SystemExit(subprocess.run(
+    [sys.argv[1], "list"],
+    stdin=subprocess.DEVNULL,
+    stdout=subprocess.DEVNULL,
+    stderr=subprocess.DEVNULL,
+).returncode)
+PY
+  then
+    return 0
+  fi
+
+  # CASAN's local compose files use public images only. If Docker Desktop's
+  # credential helper is broken, isolate this process from it without changing
+  # ~/.docker/config.json or touching any stored login credentials.
+  context_name="$(docker context show)"
+  docker_host="$(docker context inspect --format '{{(index .Endpoints "docker").Host}}' "$context_name")"
+  [[ -n "$docker_host" ]] || { echo "CASAN_LOCAL_DOCKER_CONTEXT_INVALID context=$context_name" >&2; return 1; }
+  fallback_config="${TMPDIR:-/tmp}/casan-docker-public-$UID"
+  mkdir -p "$fallback_config"
+  if [[ -d "$original_config/cli-plugins" && ! -e "$fallback_config/cli-plugins" ]]; then
+    ln -s "$original_config/cli-plugins" "$fallback_config/cli-plugins"
+  fi
+  umask 077
+  printf '%s\n' '{"auths":{"https://index.docker.io/v1/":{},"quay.io":{}}}' > "$fallback_config/config.json"
+  export DOCKER_CONFIG="$fallback_config"
+  export DOCKER_HOST="$docker_host"
+  export DOCKER_BUILDKIT=0
+  export COMPOSE_DOCKER_CLI_BUILD=0
+  echo "CASAN_LOCAL_DOCKER_CREDENTIAL_FALLBACK helper=$credential_store context=$context_name builder=classic" >&2
+}
+
 cp_compose() {
   if [[ -f "$AUTH_BRIDGE_TOKEN_FILE" ]]; then
     export CASAN_AUTH_BRIDGE_TOKEN
@@ -35,6 +114,8 @@ cp_compose() {
 }
 
 start_auth_bridge() {
+  local python_bin
+  python_bin="$(resolve_python)" || return 1
   mkdir -p "$AUTH_BRIDGE_DIR"
   if [[ ! -s "$AUTH_BRIDGE_TOKEN_FILE" ]]; then
     openssl rand -hex 32 > "$AUTH_BRIDGE_TOKEN_FILE"
@@ -52,7 +133,7 @@ start_auth_bridge() {
     rm -f "$AUTH_BRIDGE_PID_FILE"
   fi
   [[ -f "$AUTH_BRIDGE" ]] || { echo "CASAN_AUTH_BRIDGE_MISSING" >&2; return 1; }
-  nohup python3 "$AUTH_BRIDGE" --bind 0.0.0.0 --port 20130 --token-file "$AUTH_BRIDGE_TOKEN_FILE" --audit-log "$AUTH_BRIDGE_AUDIT" > "$AUTH_BRIDGE_LOG" 2>&1 &
+  nohup "$python_bin" "$AUTH_BRIDGE" --bind 0.0.0.0 --port 20130 --token-file "$AUTH_BRIDGE_TOKEN_FILE" --audit-log "$AUTH_BRIDGE_AUDIT" > "$AUTH_BRIDGE_LOG" 2>&1 &
   echo "$!" > "$AUTH_BRIDGE_PID_FILE"
   chmod 600 "$AUTH_BRIDGE_PID_FILE" "$AUTH_BRIDGE_LOG" "$AUTH_BRIDGE_AUDIT" 2>/dev/null || true
   if ! wait_url "http://127.0.0.1:20130/healthz"; then
@@ -74,6 +155,7 @@ stop_auth_bridge() {
 
 need_docker() {
   command -v docker >/dev/null 2>&1 || { echo "CASAN_LOCAL_DOCKER_MISSING" >&2; exit 1; }
+  prepare_docker_cli
   docker compose version >/dev/null 2>&1 || { echo "CASAN_LOCAL_COMPOSE_MISSING" >&2; exit 1; }
 }