Adds the missing bind mount that persists FlowAgent's delegated-user MSAL token cache across ai_mcpo restarts. Companion to homelab/mcp-config#9 (dual-audience token pre-warm + headless-auth guard) — see that PR for the corrected root-cause analysis of the 2026-09-08 stall.
Change
Single line added to the mcpo service's volumes: list in ai/ai.yaml:
config.json.template's flowagent entry sets HOME=/app/flowagent-auth for the flowagent subprocess — this is where FlowAgent's MsalTokenProvider disk cache plugin (createMsalDiskCachePlugin, packages/core/dist/auth/msal-disk-cache.js) writes its serialized MSAL token cache (default path resolves via XDG_CACHE_HOME/HOME, see defaultMsalCacheDir()).
Reviewing the current mcpo service's mount list confirmed it was not persisted — mounts were only ssh_keys, config.json, mcpo_data, uv-cache. Any successful delegated-user MSAL sign-in for list_connections / create_connection / resolve_refs / pick_or_create_connection / resolve_params would be silently lost on every mcpo restart or redeploy, forcing a fresh (currently guarded-against, see companion PR) interactive sign-in every time.
Pre-flight already done
Host directory pre-created on shared CephFS (identical across all three docker LXCs per infra convention):
mkdir -p /volume1/docker/mcpo/flowagent-auth
Verified present via ls -la /volume1/docker/mcpo/ on docker-2 (LXC 4032).
Scope check
Diff is the single mount-list line only — no image tag change, no other service touched.
Does not modify mcpo-critical (Proxmox-access service, explicitly excluded per infra convention).
Deploy note
This is a single-file stack (ai.yaml, no folder+extension-file merge) — stack-deploy.sh will render it via envsubst (not docker compose config), so the existing $-escaping in the file is already correct for that path and untouched by this change.
Depends on / should merge alongside homelab/mcp-config#9 for the fixes to be coherent, but this mount is safe to deploy independently (adding a new empty-but-precreated bind mount to an existing service does not require the image-side changes to be present first).
## Summary
Adds the missing bind mount that persists FlowAgent's delegated-user MSAL token cache across `ai_mcpo` restarts. Companion to `homelab/mcp-config#9` (dual-audience token pre-warm + headless-auth guard) — see that PR for the corrected root-cause analysis of the 2026-09-08 stall.
## Change
Single line added to the `mcpo` service's `volumes:` list in `ai/ai.yaml`:
```yaml
- /volume1/docker/mcpo/flowagent-auth:/app/flowagent-auth
```
## Why
`config.json.template`'s `flowagent` entry sets `HOME=/app/flowagent-auth` for the flowagent subprocess — this is where FlowAgent's `MsalTokenProvider` disk cache plugin (`createMsalDiskCachePlugin`, `packages/core/dist/auth/msal-disk-cache.js`) writes its serialized MSAL token cache (default path resolves via `XDG_CACHE_HOME`/`HOME`, see `defaultMsalCacheDir()`).
Reviewing the current `mcpo` service's mount list confirmed it was **not** persisted — mounts were only `ssh_keys`, `config.json`, `mcpo_data`, `uv-cache`. Any successful delegated-user MSAL sign-in for `list_connections` / `create_connection` / `resolve_refs` / `pick_or_create_connection` / `resolve_params` would be silently lost on every mcpo restart or redeploy, forcing a fresh (currently guarded-against, see companion PR) interactive sign-in every time.
## Pre-flight already done
Host directory pre-created on shared CephFS (identical across all three docker LXCs per infra convention):
```
mkdir -p /volume1/docker/mcpo/flowagent-auth
```
Verified present via `ls -la /volume1/docker/mcpo/` on docker-2 (LXC 4032).
## Scope check
- Diff is the single mount-list line only — no image tag change, no other service touched.
- Does not modify `mcpo-critical` (Proxmox-access service, explicitly excluded per infra convention).
## Deploy note
This is a single-file stack (`ai.yaml`, no folder+extension-file merge) — `stack-deploy.sh` will render it via `envsubst` (not `docker compose config`), so the existing `$`-escaping in the file is already correct for that path and untouched by this change.
Depends on / should merge alongside `homelab/mcp-config#9` for the fixes to be coherent, but this mount is safe to deploy independently (adding a new empty-but-precreated bind mount to an existing service does not require the image-side changes to be present first).
Adds the missing bind mount for FlowAgent's delegated-user MSAL disk
token cache:
/volume1/docker/mcpo/flowagent-auth:/app/flowagent-auth
Confirmed via `docker service inspect ai_mcpo --format '{{json .Spec.TaskTemplate.ContainerSpec.Mounts}}'`-equivalent review of the current
compose that mcpo's mounts were only: ssh_keys, config.json, mcpo_data,
uv-cache -- flowagent-auth (set as HOME for the flowagent subprocess via
config.json.template's env.HOME=/app/flowagent-auth) was NOT persisted,
so any successful delegated-user MSAL sign-in (list_connections /
create_connection / resolve_refs / pick_or_create_connection /
resolve_params -- the tools that use MsalTokenProvider, see companion
homelab/mcp-config PR #9) would be silently lost on every mcpo restart,
forcing a fresh interactive sign-in every time.
Host dir already exists (pre-created on shared CephFS, identical across
all three docker LXCs):
mkdir -p /volume1/docker/mcpo/flowagent-auth
This does NOT change the flowagent image tag/pin -- that stays
git.bryanmail.net/homelab/flowagent-mcpo:c5b22618404a pending the
companion mcp-config PR merging and its Woodpecker build producing a new
commit-sha tag to bump to.
No other changes to ai.yaml in this commit -- diff is mount-list addition
only.
AVB
merged commit 000792f702 into main2026-09-09 08:45:02 -07:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Summary
Adds the missing bind mount that persists FlowAgent's delegated-user MSAL token cache across
ai_mcporestarts. Companion tohomelab/mcp-config#9(dual-audience token pre-warm + headless-auth guard) — see that PR for the corrected root-cause analysis of the 2026-09-08 stall.Change
Single line added to the
mcposervice'svolumes:list inai/ai.yaml:Why
config.json.template'sflowagententry setsHOME=/app/flowagent-authfor the flowagent subprocess — this is where FlowAgent'sMsalTokenProviderdisk cache plugin (createMsalDiskCachePlugin,packages/core/dist/auth/msal-disk-cache.js) writes its serialized MSAL token cache (default path resolves viaXDG_CACHE_HOME/HOME, seedefaultMsalCacheDir()).Reviewing the current
mcposervice's mount list confirmed it was not persisted — mounts were onlyssh_keys,config.json,mcpo_data,uv-cache. Any successful delegated-user MSAL sign-in forlist_connections/create_connection/resolve_refs/pick_or_create_connection/resolve_paramswould be silently lost on every mcpo restart or redeploy, forcing a fresh (currently guarded-against, see companion PR) interactive sign-in every time.Pre-flight already done
Host directory pre-created on shared CephFS (identical across all three docker LXCs per infra convention):
Verified present via
ls -la /volume1/docker/mcpo/on docker-2 (LXC 4032).Scope check
mcpo-critical(Proxmox-access service, explicitly excluded per infra convention).Deploy note
This is a single-file stack (
ai.yaml, no folder+extension-file merge) —stack-deploy.shwill render it viaenvsubst(notdocker compose config), so the existing$-escaping in the file is already correct for that path and untouched by this change.Depends on / should merge alongside
homelab/mcp-config#9for the fixes to be coherent, but this mount is safe to deploy independently (adding a new empty-but-precreated bind mount to an existing service does not require the image-side changes to be present first).Adds the missing bind mount for FlowAgent's delegated-user MSAL disk token cache: /volume1/docker/mcpo/flowagent-auth:/app/flowagent-auth Confirmed via `docker service inspect ai_mcpo --format '{{json .Spec.TaskTemplate.ContainerSpec.Mounts}}'`-equivalent review of the current compose that mcpo's mounts were only: ssh_keys, config.json, mcpo_data, uv-cache -- flowagent-auth (set as HOME for the flowagent subprocess via config.json.template's env.HOME=/app/flowagent-auth) was NOT persisted, so any successful delegated-user MSAL sign-in (list_connections / create_connection / resolve_refs / pick_or_create_connection / resolve_params -- the tools that use MsalTokenProvider, see companion homelab/mcp-config PR #9) would be silently lost on every mcpo restart, forcing a fresh interactive sign-in every time. Host dir already exists (pre-created on shared CephFS, identical across all three docker LXCs): mkdir -p /volume1/docker/mcpo/flowagent-auth This does NOT change the flowagent image tag/pin -- that stays git.bryanmail.net/homelab/flowagent-mcpo:c5b22618404a pending the companion mcp-config PR merging and its Woodpecker build producing a new commit-sha tag to bump to. No other changes to ai.yaml in this commit -- diff is mount-list addition only.