Fix menu actions in the session that installs

[BenWestgate]

Requested by Ben · project thread

Stacked on #311, which removes wrapped. Merge #311 first; GitHub then retargets this PR to master.

Before: in the Tails session that installed CipherStick, opening codex32 from the menu says "Bitcoin Core unavailable" while Core is running. "Update Bitcoin Core" can't find install-core if a Console window is open. "Update Bitcoin Core" also fails after any first install with cd: bitcoin-core-VER: No such file or directory.

After: all three work without a restart.

How

• open-codex32: adds ~/.local/bin to PATH when it's missing. That session logged in before the folder existed, and the python-codex32 GUI also finds bitcoin-cli through PATH. The unavailable dialog now also says that an open Core message blocks startup.
• bails-menu: runs install-core by full path. When a Console window is already open, kgx -- cmd runs the command in that window's process with that process's PATH. I checked this with gnome-console 46.
• install-core: pulls guix.sigs with git -C instead of cd-ing into it and never changing back. Master has the same bug.

Scan, on top of #311 (fake-Tails, real Core 32.0rc2)
I ran a full install of this branch, then ran every launch path with the menu session's PATH, without ~/.local/bin:

• Menu: Network Privacy, Backup, Clone, Update Bitcoin Core, Help > Donate.
• codex32 entry: the Core check.
• Core started from its menu entry, which runs core-started through startupnotify.

Nothing was missing on this branch, and the Core update completed and restarted Core. On #311 alone, the codex32 Core check fails because it can't find bitcoin-cli. #311 already has the PATH guard in bails-menu and core-started, and it gives startupnotify a full path. Autostart and b source ~/.profile.

Testing

• tests/open-codex32-core.sh and tests/core-dbcache.sh pass.
• shellcheck is clean on bails-menu and install-core. open-codex32 shows only the SC2119/SC2120 notes it already had.
• Not run on real Tails.

🤖 Generated with Claude Code

https://claude.ai/code/session_01CUXR1M1FCGzuX6J6qAzrjo

[BenWestgate]

The github-advanced-security check is red, but this PR doesn't cause it. It fails on every PR here because of the repository's Copilot model setting, not because of code. The checks that look at code all pass: Check shell code, CodeQL / Analyze (actions) and dependency-review. There is no code fix to port, so I'm leaving it as is.

---

Generated by Claude Code

[BenWestgate]

cACK
you might want to scan the project more thoroughly for other scripts and apps that don't work correctly on the first boot because $PATH is missing ~/.local/bin this may not be the only issue. Return with your findings and I will code review.

[BenWestgate]

I scanned every launch point and found one more first-session PATH gap. It's fixed in 35e6c76.

• "Update Bitcoin Core" in the menu: kgx -- install-core runs in the already-open Console window's process, with that process's PATH, not the menu's. A Console opened in the install session has no ~/.local/bin, so install-core wasn't found. I checked the forwarding with gnome-console 46: the second window got the first window's PATH. The menu now runs install-core by its full path.
• Fine as is: menu entries that go through wrapped (it sources ~/.profile, and Core, chainstate-preload, link-dotfiles, stop-btc and bails-backup inherit that), bitcoin: links (bitcoin-qt.desktop runs wrapped), and "Update CipherStick" (b sources ~/.profile). The autostart's bare Exec=wrapped only runs at a later login, when ~/.local/bin exists.

I rebased onto master for #294's menu change. The full list is in the PR description.

---

Generated by Claude Code

[BenWestgate]

Merge order: #316 first, then #311. [Edit: Ben asked for this PR to be rebased onto #311's removal of wrapped. #316 is now stacked on #311, so #311 merges first. #311 now has the bails-menu and core-started PATH guards and a full-path startupnotify itself. The re-scan on top of #311 is in the PR description.]

---

Generated by Claude Code

[chatgpt-codex-connector]

💡 Codex Review

Bails/bails/.local/bin/core-dbcache

Line 201 in 0329c1c

if core_pid >/dev/null && prune_too_big; then

Recheck Core after refreshing an oversized prune target

Because bitcoin.desktop and cipherstick.desktop are independent autostarts, Core can be absent during this one-shot check and start immediately afterward, before refresh lowers an oversized persisted prune target. In that interleaving restart remains empty, so Core keeps the old target it already parsed even though the configuration is rewritten, allowing block data to consume the remaining USB space—the exact condition this guard is intended to prevent. Preserve the pre-refresh prune_too_big result and check for Core again after refreshing, or otherwise serialize the launches.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[BenWestgate]

The Codex finding is about core-dbcache (the restart check around line 201). That file belongs to #311, which this PR is stacked on, and #316 doesn't change it. #311's thread confirmed and fixed the race in d98d33d. The login step now checks the prune target before the refresh and checks again afterwards for a Core that started in between, and there's a new test case. I rebased #316 onto that head.

---

Generated by Claude Code

[BenWestgate]

Codex current-head review at a0598ea: no findings. The first-session PATH gaps are handled at both launch points, and git -C guix.sigs fixes the cwd leak without changing the signed-release verification flow.

[BenWestgate]

Rebased onto #311's squashed commit (35f2b15). The old pre-squash #311 commits are dropped, and this branch's three commits applied cleanly. Tests pass. Once #311 merges, only the three menu commits will be left.

---

Generated by Claude Code

[BenWestgate]

Rebased again, this time onto #311's amended commit 9ed40bc. Tests pass.

---

Generated by Claude Code

[BenWestgate]

I rebased onto #311's current head (b171457) and pushed d5c8962. The diff is still only the three fixes, with no conflicts. cipherstick.sh, core-dbcache.sh, core-dbcache-review-regressions.sh and open-codex32-core.sh pass, and shellcheck is clean. cryostick-qr-roundtrip.sh stops with "missing bitcoind" because this container has no Core install, so I didn't run it.

I re-checked the launchers on the new head. bails-menu and open-codex32 still carry the PATH guard, and the new cipherstick and cryostick autostarts are absolute paths that set up PATH themselves. #311 no longer uses startupnotify.

The supported-Tails end-to-end check is still open, since this container can't run Tails. It needs a real Tails boot: install, then from the menu without a reboot, open codex32 and run Update Bitcoin Core.

---

Generated by Claude Code

[BenWestgate]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-07T04:34:54.259334Z	7797403	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[BenWestgate]

AI current-head review: ACK 7797403. The three changes directly address first-session integration failures without widening behavior: the menu invokes install-core by absolute user-bin path, install-core updates guix.sigs without leaking its working directory, and open-codex32 repairs the login-session PATH before probing Core. Existing threads are resolved and exact-head lint CI is green. No finding.