Load Codespaces secrets before starting the server

A codespace came up serving nothing. The image was fine and the hook did run, but
the log was empty and OPENCODE_SERVER_PASSWORD was absent from the environment.

Codespaces secrets are not passed to postStartCommand. They are written to
/workspaces/.codespaces/shared/user-secrets-envs.json and applied to interactive
shells, so a server started by a lifecycle hook sees none of them — and
entrypoint.sh then refuses to run, exactly as it should, leaving a public port
with nothing behind it.

start-opencode.sh reads that file first, without overriding anything
devcontainer.json set explicitly, and says so plainly when the password is still
missing rather than failing silently.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.devcontainer/devcontainer.json

@@ -53,12 +53,12 @@
   },
 
   // Runs on create *and* on every resume from an idle stop, which is what makes the codespace
-  // behave like a server rather than a dev box you have to log into and restart by hand.
-  // Backgrounded so the codespace can finish starting; the log is where a refused boot
-  // (usually a missing password) explains itself.
-  // setsid detaches the server from the shell that postStartCommand runs in, which exits as
-  // soon as it returns; a plain background job is not guaranteed to outlive it.
-  "postStartCommand": "setsid nohup /home/node/entrypoint.sh > /tmp/opencode.log 2>&1 < /dev/null & echo started",
+  // behave like a server rather than a dev box you have to restart by hand.
+  //
+  // It goes through start-opencode.sh rather than straight to the entrypoint because
+  // Codespaces secrets are not in this hook's environment — see that script. setsid detaches
+  // the server from the shell, which exits as soon as the hook returns.
+  "postStartCommand": "setsid nohup ${containerWorkspaceFolder}/.devcontainer/start-opencode.sh > /tmp/opencode.log 2>&1 < /dev/null & echo started",
 
   "customizations": {
     "vscode": {

.devcontainer/start-opencode.sh

@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+# Boot the opencode server inside a GitHub Codespace.
+#
+# This exists for one reason: Codespaces secrets are not in postStartCommand's environment.
+# They are written to a JSON file and applied to interactive shells, so a server started by
+# the lifecycle hook sees none of them — including OPENCODE_SERVER_PASSWORD, without which
+# entrypoint.sh correctly refuses to run and the codespace comes up serving nothing.
+#
+# Sourcing that file first is what makes the codespace behave like the Space and the Railway
+# service, where the platform hands the process its variables directly.
+set -euo pipefail
+
+SECRETS="/workspaces/.codespaces/shared/user-secrets-envs.json"
+
+if [ -f "$SECRETS" ]; then
+  # A flat { "NAME": "value" } object. Exported only if not already set, so a variable given
+  # explicitly by devcontainer.json still wins.
+  while IFS='=' read -r name value; do
+    [ -n "$name" ] || continue
+    if [ -z "${!name:-}" ]; then
+      export "$name=$value"
+    fi
+  done < <(python3 -c '
+import json, sys
+with open(sys.argv[1]) as handle:
+    for name, value in json.load(handle).items():
+        if isinstance(value, str) and "\n" not in value:
+            print(f"{name}={value}")
+' "$SECRETS")
+  echo "codespaces: loaded secrets from $(basename "$SECRETS")"
+else
+  echo "codespaces: no secrets file at $SECRETS"
+fi
+
+if [ -z "${OPENCODE_SERVER_PASSWORD:-}" ]; then
+  echo "codespaces: OPENCODE_SERVER_PASSWORD is still unset after loading secrets." >&2
+  echo "            Set it as a Codespaces secret, not a repository or Actions secret:" >&2
+  echo "            gh secret set OPENCODE_SERVER_PASSWORD --app codespaces --repo OWNER/REPO" >&2
+fi
+
+exec /home/node/entrypoint.sh