From 30d00cc61aa4ba64119c3909e6f9f115b95bda12 Mon Sep 17 00:00:00 2001
From: Declan Carroll <declan@n8n.io>
Date: Thu, 3 Sep 2026 17:14:13 +0100
Subject: [PATCH] fix: Load Codespaces worker secrets before startup
 (no-changelog) (#37767)

---
 .devcontainer/codespaces/README.md             | 4 ++++
 .devcontainer/codespaces/agent-worker.test.mjs | 9 +++++++++
 .devcontainer/codespaces/post-start.mjs        | 2 +-
 3 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/.devcontainer/codespaces/README.md b/.devcontainer/codespaces/README.md
index 3bd5bd20473..39e459539c9 100644
--- a/.devcontainer/codespaces/README.md
+++ b/.devcontainer/codespaces/README.md
@@ -68,6 +68,10 @@ same way as `ANTHROPIC_API_KEY`:
 - `OPENROUTER_API_KEY` — the model provider key for Sol.
 - `SLACK_BOT_TOKEN` — optional bot token for progress messages. It needs `chat:write` only.
 
+The worker explicitly reloads `/usr/local/lib/codespaces-env.sh` when its tmux
+session starts. An existing tmux server can otherwise retain an environment
+that did not load the Codespaces secrets.
+
 The dequeue payload can include `slack.channel` and `slack.thread_ts`. The
 worker posts one placeholder in that thread. It coalesces completed tool calls.
 It updates the message at most once every 1.5 seconds. It does not send reasoning
diff --git a/.devcontainer/codespaces/agent-worker.test.mjs b/.devcontainer/codespaces/agent-worker.test.mjs
index b3d76681434..b0c8d3d5d51 100644
--- a/.devcontainer/codespaces/agent-worker.test.mjs
+++ b/.devcontainer/codespaces/agent-worker.test.mjs
@@ -1,5 +1,6 @@
 import assert from 'node:assert/strict';
 import { EventEmitter } from 'node:events';
+import { readFileSync } from 'node:fs';
 import { PassThrough } from 'node:stream';
 import { test } from 'node:test';
 import { setTimeout as sleep } from 'node:timers/promises';
@@ -11,6 +12,14 @@ const turn = {
 	slack: { channel: 'C123', thread_ts: '123.456' },
 };
 
+test('reloads Codespaces secrets before the worker starts', () => {
+	const postStart = readFileSync(new URL('./post-start.mjs', import.meta.url), 'utf8');
+	assert.match(
+		postStart,
+		/bash -lc "\. \/usr\/local\/lib\/codespaces-env\.sh; .*node \/workspaces\/n8n\/\.devcontainer\/codespaces\/agent-worker\.mjs/,
+	);
+});
+
 function slackRecorder() {
 	const calls = [];
 	return {
diff --git a/.devcontainer/codespaces/post-start.mjs b/.devcontainer/codespaces/post-start.mjs
index 5575911de10..ed76619d131 100644
--- a/.devcontainer/codespaces/post-start.mjs
+++ b/.devcontainer/codespaces/post-start.mjs
@@ -75,5 +75,5 @@ tryRun('worker start', 'tmux', [
 	'-d',
 	'-s',
 	'agent-worker',
-	'bash -lc "export CLAUDE_CODE_PLUGIN_PREFER_HTTPS=1 CLAUDE_CODE_PLUGIN_KEEP_MARKETPLACE_ON_FAILURE=1; node /workspaces/n8n/.devcontainer/codespaces/agent-worker.mjs >> /tmp/agent-worker.log 2>&1"',
+	'bash -lc ". /usr/local/lib/codespaces-env.sh; export CLAUDE_CODE_PLUGIN_PREFER_HTTPS=1 CLAUDE_CODE_PLUGIN_KEEP_MARKETPLACE_ON_FAILURE=1; node /workspaces/n8n/.devcontainer/codespaces/agent-worker.mjs >> /tmp/agent-worker.log 2>&1"',
 ]);