Approach B: own device_id + is_container flag + stable container id

[sumit-badsara]

Summary

Implements step ③ of Approach B (user-centric device attribution) for the coding-discovery-tool. Under Approach B, every host and every container reports its own device_id and a plain home_user, attributed to the authenticated API-key owner on the backend — instead of containers masquerading as the host device.

This supersedes PR #165 (feat/device-id-host-override), which did device_id injection + home_user namespacing. Those are not carried forward. Only the in_container() helper is salvaged from that branch. (PR #165 is left open per operator decision.)

Changes

• Salvage in_container() into utils.py — best-effort container detection (/.dockerenv, /run/.containerenv, overlay root mount, cgroup-v1 fallback), lru_cached. The get_device_id injection override and home_user namespacing from Container-aware device identity: inject host device_id + namespace home_user per container #165 are deliberately omitted.
• is_container top-level report field — added to the dict built by generate_single_tool_report (ai_tools_discovery.py), set from in_container(). Lives in the report dict only (not inside the tool payload, so it does not affect the tool-level dedup hash). Harmless/ignored on backends that don't yet read it; stored once backend steps ①+② land.
• Stable container device_id (linux/device_id.py) — when /etc/machine-id is empty/absent, fall back to a UUID persisted in the home-user's ~/.unbound/ (read if present, else generate uuid4 + write) instead of the ephemeral hostname, so a restarted container that mounts a persistent ~/.unbound keeps a single device row instead of exploding into one row per launch. Reuses cache._ensure_state_dir() (the repo's canonical state-dir resolver with a writable fallback) rather than a bare Path.home() — co-locating the device id next to the API key written by unbound login. Machine-id-first behavior is unchanged; the fallback never raises (returns an unpersisted uuid if the dir is unwritable).

Tests

New tests/test_container_attribution.py (12 tests, all green):

• is_container present, top-level (not in tool payload), correct value, and home_user not namespaced.
• in_container() detection (dockerenv / containerenv / no-markers), with lru_cache clearing between toggles.
• Persisted-UUID device_id fallback: machine-id precedence preserved; generate+write on first call; read-existing on restart (no regeneration); unwritable state dir returns unpersisted uuid; write-failure still returns the uuid.

python3 -m pytest tests/ -q → 842 passed, 1 skipped, 1 pre-existing failure (test_main_cli_with_queue_drain — verified to fail identically on clean origin/main, unrelated to this change).

🤖 Generated with Claude Code

Greptile Summary

This PR implements Approach B container attribution: every host and container independently reports its own device_id and plain home_user rather than containers masquerading as the host. It salvages the in_container() detector from the now-superseded PR #165, adds an is_container top-level flag to the report payload, and replaces the ephemeral hostname fallback with a UUID persisted under ~/.unbound/device-id when /etc/machine-id is absent.

• in_container() helper added to utils.py with three detection signals (.dockerenv/.containerenv, overlay root mount, cgroup v1 markers), lru_cached for process lifetime.
• is_container field injected at the top level of the generate_single_tool_report output (not inside the tool payload, preserving dedup-hash stability) — backward-compatible with backends that don't yet read it.
• Stable container device_id in linux/device_id.py: atomic write (mkstemp + os.replace), UUID format validation on read with regeneration on corrupt values, and warning-level logging on all failure branches — addressing all three previous review threads on this file.

Confidence Score: 5/5

Safe to merge — all three previously flagged concerns (write atomicity, UUID validation, log levels) are fully addressed and covered by new tests.

The changes are well-scoped: a new top-level report field computed from a cached helper, and a hardened device-id fallback path. The atomic write pattern mirrors the existing cache.atomic_write_cache() exactly, UUID validation correctly rejects corrupt values and regenerates, and all failure branches log at warning level. The 12 new tests exercise the full state machine including corruption, write failures, and cache-clearing between state toggles. No regressions to existing behavior — machine-id still takes precedence, home_user is not namespaced.

No files require special attention.

Important Files Changed

Filename	Overview
scripts/coding_discovery_tools/linux/device_id.py	Replaces ephemeral hostname fallback with atomic persisted-UUID mechanism; atomic write, UUID validation, and warning-level logging all correctly implemented. Previous review concerns fully addressed.
scripts/coding_discovery_tools/utils.py	Adds lru_cached in_container() with three complementary detection signals; each signal is independently guarded with OSError; returns False on non-Linux hosts as expected.
scripts/coding_discovery_tools/ai_tools_discovery.py	Minimal change: imports in_container and sets is_container at the report top-level (not in tool payload). Both import paths (relative and absolute fallback) are correctly updated.
tests/test_container_attribution.py	New test file covering is_container placement, in_container() detection (including lru_cache clearing), machine-id precedence, generate+write, read-existing, corrupt-regeneration, unwritable-dir, and write-failure paths.
tests/test_copilot_cli_discovery.py	Trivial blank-line removal between two test methods; no logic change.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[extract_device_id - Linux] --> B{machine-id readable\nand non-empty?}
    B -- Yes --> C[Return machine-id]
    B -- No --> D[_persisted_device_id]

    D --> E{cache._ensure_state_dir\nreturns True?}
    E -- No --> F[warning: no usable state dir\nReturn ephemeral uuid4]
    E -- Yes --> G{device-id file\nexists and non-empty?}

    G -- Yes --> H{uuid.UUID validate}
    H -- Valid --> I[Return persisted UUID]
    H -- ValueError --> J[warning: corrupt value\nfall through to generate]

    G -- No --> K[Generate new uuid4]
    J --> K

    K --> L{atomic write:\nmkstemp + os.replace}
    L -- Success --> M[Return new UUID\npersisted on disk]
    L -- OSError --> N[warning: write failed\nReturn new UUID unpersisted]

Loading

_{Reviews (3): Last reviewed commit: "Merge origin/staging: WEB-4662 lock-less..." | Re-trigger Greptile}