From 2ada90a6f6298ecec6753a087d7234b093a22e26 Mon Sep 17 00:00:00 2001
From: Pigbibi <20649888+Pigbibi@users.noreply.github.com>
Date: Fri, 17 Jul 2026 02:55:18 +0800
Subject: [PATCH] fix(ops): refresh stale 2FA bot bind mounts

Co-Authored-By: Codex <noreply@openai.com>
---
 .github/workflows/main.yml               | 8 ++++++--
 .github/workflows/remote-maintenance.yml | 4 ++--
 tests/test_workflow_shared_config.sh     | 6 +++++-
 3 files changed, 13 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 56e042c..f53f1bf 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -650,7 +650,12 @@ jobs:
             echo "[\$(date -u +%FT%TZ)] Keepalive fallback: image \${compose_image} is missing, building only \${compose_service_name}"
             sudo docker compose build "\${compose_service_name}"
           fi
-          sudo env IB_GATEWAY_CONTAINER_NAME="\${container_name}" IB_GATEWAY_UNIT_SUFFIX="\${IB_GATEWAY_UNIT_SUFFIX:-}" bash ./scripts/install_2fa_bot_watcher.sh
+          host_2fa_bot_sha256="\$(sha256sum ./2fa_bot.py | awk '{print \$1}')"
+          container_2fa_bot_sha256="\$(sudo timeout 15 docker exec "\${container_name}" sha256sum /home/ibgateway/2fa_bot.py 2>/dev/null | awk '{print \$1}' || true)"
+          if [ "\${container_2fa_bot_sha256}" != "\${host_2fa_bot_sha256}" ]; then
+            echo "[\$(date -u +%FT%TZ)] Refreshing stale 2FA bot bind mount for \${container_name}"
+            sudo docker compose up -d --force-recreate --no-build "\${compose_service_name}"
+          fi
           sudo env IB_GATEWAY_CONTAINER_NAME="\${container_name}" IB_GATEWAY_COMPOSE_SERVICE_NAME="\${compose_service_name}" bash ./scripts/recover_ib_gateway_ready.sh '${IB_GATEWAY_MODE}'
           restore_gateway_watchers
           sudo docker compose ps
@@ -698,7 +703,6 @@ jobs:
           sudo docker compose down
           sudo docker compose up -d "\${compose_service_name}"
 
-          sudo env IB_GATEWAY_CONTAINER_NAME="\${container_name}" IB_GATEWAY_UNIT_SUFFIX="\${IB_GATEWAY_UNIT_SUFFIX:-}" bash ./scripts/install_2fa_bot_watcher.sh
           sudo env IB_GATEWAY_CONTAINER_NAME="\${container_name}" IB_GATEWAY_COMPOSE_SERVICE_NAME="\${compose_service_name}" bash ./scripts/recover_ib_gateway_ready.sh '${IB_GATEWAY_MODE}'
           restore_gateway_watchers
           sudo docker compose ps
diff --git a/.github/workflows/remote-maintenance.yml b/.github/workflows/remote-maintenance.yml
index fbb6bda..741e820 100644
--- a/.github/workflows/remote-maintenance.yml
+++ b/.github/workflows/remote-maintenance.yml
@@ -269,9 +269,9 @@ jobs:
           resolve_ibkr_gateway_unit_names "${container_name}" "${unit_suffix}"
           sudo systemctl stop "${IBKR_GATEWAY_HEALTHCHECK_TIMER}" "${IBKR_GATEWAY_HEALTHCHECK_SERVICE}" 2>/dev/null || true
           sudo systemctl stop "${IBKR_GATEWAY_DAILY_RESTART_TIMER}" "${IBKR_GATEWAY_DAILY_RESTART_SERVICE}" 2>/dev/null || true
-          sudo docker compose up -d --no-build "${compose_service_name}"
-          sudo env IB_GATEWAY_CONTAINER_NAME="${container_name}" IB_GATEWAY_UNIT_SUFFIX="${unit_suffix}" bash ./scripts/install_2fa_bot_watcher.sh
+          sudo docker compose up -d --force-recreate --no-build "${compose_service_name}"
           sudo env IB_GATEWAY_CONTAINER_NAME="${container_name}" IB_GATEWAY_COMPOSE_SERVICE_NAME="${compose_service_name}" bash ./scripts/recover_ib_gateway_ready.sh __IB_GATEWAY_MODE__
+          sudo env IB_GATEWAY_CONTAINER_NAME="${container_name}" IB_GATEWAY_UNIT_SUFFIX="${unit_suffix}" bash ./scripts/install_2fa_bot_watcher.sh
           sudo env IB_GATEWAY_CONTAINER_NAME="${container_name}" IB_GATEWAY_COMPOSE_SERVICE_NAME="${compose_service_name}" IB_GATEWAY_UNIT_SUFFIX="${unit_suffix}" bash ./scripts/install_gateway_health_watcher.sh __IB_GATEWAY_MODE__
           sudo docker compose ps
           EOF
diff --git a/tests/test_workflow_shared_config.sh b/tests/test_workflow_shared_config.sh
index 3511333..8e8e26e 100644
--- a/tests/test_workflow_shared_config.sh
+++ b/tests/test_workflow_shared_config.sh
@@ -77,6 +77,10 @@ grep -Fq 'gcloud compute instances reset "${GCE_INSTANCE_NAME}"' "$workflow_file
 grep -Fq 'run_remote_ssh "Repository sync" "${REMOTE_SYNC_COMMAND}"' "$workflow_file"
 grep -Fq 'copy_remote_file "${ENV_FILE}" "${DEPLOY_PATH}/.env"' "$workflow_file"
 grep -Fq 'sudo bash ./scripts/ensure_host_swap.sh' "$workflow_file"
+grep -Fq 'host_2fa_bot_sha256="\$(sha256sum ./2fa_bot.py' "$workflow_file"
+grep -Fq 'container_2fa_bot_sha256="\$(sudo timeout 15 docker exec' "$workflow_file"
+grep -Fq 'Refreshing stale 2FA bot bind mount for \${container_name}' "$workflow_file"
+grep -Fq 'sudo docker compose up -d --force-recreate --no-build "\${compose_service_name}"' "$workflow_file"
 grep -Fq 'resolve_ibkr_gateway_unit_names "\${container_name}" "\${IB_GATEWAY_UNIT_SUFFIX:-}"' "$workflow_file"
 grep -Fq 'sudo systemctl stop "\${IBKR_GATEWAY_HEALTHCHECK_TIMER}" "\${IBKR_GATEWAY_HEALTHCHECK_SERVICE}" 2>/dev/null || true' "$workflow_file"
 grep -Fq 'bash ./scripts/install_gateway_health_watcher.sh' "$workflow_file"
@@ -159,7 +163,7 @@ grep -Fq 'IB_GATEWAY_COMPOSE_SERVICE_NAME: target.compose_service_name' "$mainte
 grep -Fq 'sudo systemctl disable --now' "$maintenance_workflow_file"
 grep -Fq 'sudo docker update --restart=no "${container_name}"' "$maintenance_workflow_file"
 grep -Fq 'sudo docker compose down' "$maintenance_workflow_file"
-grep -Fq 'sudo docker compose up -d --no-build "${compose_service_name}"' "$maintenance_workflow_file"
+grep -Fq 'sudo docker compose up -d --force-recreate --no-build "${compose_service_name}"' "$maintenance_workflow_file"
 grep -Fq 'bash ./scripts/install_gateway_health_watcher.sh __IB_GATEWAY_MODE__' "$maintenance_workflow_file"
 
 ! grep -Fxq '        shell: python3' "$diagnose_workflow_file"