feat(server-s3): one Linux user per account (S3) — experimental
Server mode can now run each account as its own Linux user (ah-<name>) when `agenthub server install-system` has set S3 up. The dashboard reaches a member only through sudo -u / write-as / pane-launch, reads a member's files only through owner- and type-checked opens, and hooks are authenticated by peer uid. Local mode and server mode without S3 are unchanged. EXPERIMENTAL: tested with fake sudo and fake accounts only. It has not yet been verified on a real install with real member accounts, sudo or a real Codex login. Do not offer it to real users yet. - S3 core: provisioning, per-member tmux servers, the proxy key gateway, shared tools in /opt, dropped capabilities for children (P0–P5) - P4: plan and quota per member home - P6: ~/.claude.json seed; opt-in plugin baseline installed as the member; managed-settings spike script (not run) - P7: Codex account pool (`agenthub accounts add --tool codex`) - Roles merged with main's admin / analyst / developer: analysts write only their own rows, under S3 as well - Per-account prefs: one implementation (Chat UI + onboarding) - Security reviews F1–F49 (five rounds), each fix with a regression test: symlink/TOCTOU-safe member reads, no host writes in a member home, credentials and the data dir never served, owner and folder account must agree, pane tokens bound to the pane's uid, bounded sudo/tmux/git calls and member reads (no hang or crash from a member), async route rejections answer 500 instead of exiting - Docs: docs/SERVER-MODE.md (S3 model, accepted ceilings, operator runbook), docs/plans/server-mode/S3-PLAN.md, CLAUDE.md S3 rules Tests: server 2838/2841 (3 need 127.0.0.1:3000, held on this box); client 1162/1162; tsc clean; headers check passes. Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
+211
-48
@@ -12,6 +12,18 @@
|
||||
* out of the pane's rendered text, its scrollback and the user's shell history.
|
||||
* `sendText` is the one primitive that does send keystrokes — a pane running an
|
||||
* interactive chat program that reads stdin as a message, not a shell.
|
||||
*
|
||||
* Server mode, one Linux user per account (S3): a member's panes live on THAT
|
||||
* member's tmux server, socket `<home>/.agenthub/tmux/sock` (`run-as.js`), so
|
||||
* they run as the member. Every call naming a session goes there, resolved
|
||||
* from the session's workspace, and runs AS the member (`sudo -u`, tmux by
|
||||
* the absolute path sudoers lists) — never as a host client: the member owns
|
||||
* that socket's folder, and a host client on it could be handed a fake server
|
||||
* or replaced by a member's command (`detach-client -E`). sudo logs its
|
||||
* command line, so a session's environment and argv travel in a launch file
|
||||
* (`run-as.launchArgv`) and a paste on stdin. Listing covers every server.
|
||||
* With no member (local mode, S3 not installed, the host's own workspaces)
|
||||
* nothing changes.
|
||||
* @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
|
||||
*/
|
||||
|
||||
@@ -24,7 +36,7 @@ const { execFileSync } = require("node:child_process");
|
||||
// "error connecting to ..." noise to the process's stderr just spams the
|
||||
// journal on every poll while no tmux server is running yet.
|
||||
const EXEC_OPTS = { encoding: "utf8", stdio: ["pipe", "pipe", "ignore"] };
|
||||
let execImpl = (args) => execFileSync("tmux", args, EXEC_OPTS);
|
||||
let execImpl = (args, opts = EXEC_OPTS) => execFileSync("tmux", args, opts);
|
||||
|
||||
// Linux: the tmux server lives in the cgroup of whatever started it — the
|
||||
// dashboard's systemd unit, or the terminal/IDE scope a dev server runs in —
|
||||
@@ -50,6 +62,61 @@ const realScopeImpl = (args) =>
|
||||
);
|
||||
let scopeImpl = realScopeImpl;
|
||||
|
||||
// S3: the member account a session belongs to (null = the host's own server),
|
||||
// and how a tmux command runs AS that member on their server (`input` = its
|
||||
// stdin). Seams, so tests never sudo.
|
||||
let accountImpl = (name) => require("./run-as").accountForSession(name);
|
||||
// A member's server is theirs: they can stop it (SIGSTOP) or fill it with
|
||||
// sessions, and every call here blocks the event loop. So each call on it is
|
||||
// bounded (time, output), and a server that timed out or flooded us is not
|
||||
// asked again for MEMBER_BACKOFF_MS — its panes read as UNKNOWN meanwhile.
|
||||
// ponytail: a frozen member still costs one MEMBER_TIMEOUT_MS block per
|
||||
// backoff; move member calls to async execFile if that ever shows.
|
||||
const MEMBER_TIMEOUT_MS = 3000;
|
||||
const MEMBER_BACKOFF_MS = 60_000;
|
||||
const MEMBER_OPTS = { ...EXEC_OPTS, timeout: MEMBER_TIMEOUT_MS, killSignal: "SIGKILL", maxBuffer: 1 << 20 };
|
||||
const realMemberImpl = (acct, args, input) => {
|
||||
const runAs = require("./run-as");
|
||||
const [cmd, argv] = runAs.sudoArgv(acct, "tmux", ["-S", runAs.tmuxSocket(acct), ...args]);
|
||||
return execFileSync(cmd, argv, input == null ? MEMBER_OPTS : { ...MEMBER_OPTS, input });
|
||||
};
|
||||
let memberImpl = realMemberImpl;
|
||||
let unreachable = new Map(); // member login → backoff end
|
||||
function memberCall(acct, args, input) {
|
||||
if ((unreachable.get(acct.login) || 0) > Date.now()) {
|
||||
throw Object.assign(new Error(`${acct.login}: tmux server not answering`), {
|
||||
code: "ETMUXHUNG",
|
||||
});
|
||||
}
|
||||
try {
|
||||
return memberImpl(acct, args, input);
|
||||
} catch (err) {
|
||||
if (err.code === "ETIMEDOUT" || err.code === "ENOBUFS") {
|
||||
unreachable.set(acct.login, Date.now() + MEMBER_BACKOFF_MS);
|
||||
}
|
||||
throw err;
|
||||
}
|
||||
}
|
||||
function __setAccountImpl(fn, member) {
|
||||
accountImpl = fn;
|
||||
if (member) memberImpl = member;
|
||||
}
|
||||
function accountOf(name) {
|
||||
try {
|
||||
return accountImpl(name);
|
||||
} catch (err) {
|
||||
// A member's workspace with no usable account never falls back to the
|
||||
// host's server: that would run the pane as the host in their folder.
|
||||
if (err.code === "EMEMBERGONE") throw err;
|
||||
return null; // no DB yet, a malformed name: the host's own server
|
||||
}
|
||||
}
|
||||
/** Run a tmux command on the server that holds session `name`. */
|
||||
function onServerOf(name, args, input) {
|
||||
const acct = accountOf(name);
|
||||
return acct ? memberCall(acct, args, input) : execImpl(args);
|
||||
}
|
||||
|
||||
// Whether this tmux takes `=name` targets: true for tmux itself, false for
|
||||
// psmux (the WinGet `tmux` on Windows), null until a live session has shown
|
||||
// which. A fake exec in a test is real tmux unless it says otherwise.
|
||||
@@ -60,16 +127,19 @@ function __setExecImpl(fn, { exact = true } = {}) {
|
||||
scopeImpl = null; // a fake tmux never starts a real scope
|
||||
|
||||
exactTargets = exact;
|
||||
listed = null;
|
||||
listed = new Map();
|
||||
}
|
||||
function __setScopeImpl(fn) {
|
||||
scopeImpl = fn;
|
||||
}
|
||||
function __reset() {
|
||||
execImpl = (args) => execFileSync("tmux", args, EXEC_OPTS);
|
||||
execImpl = (args, opts = EXEC_OPTS) => execFileSync("tmux", args, opts);
|
||||
scopeImpl = realScopeImpl;
|
||||
accountImpl = (name) => require("./run-as").accountForSession(name);
|
||||
memberImpl = realMemberImpl;
|
||||
exactTargets = null;
|
||||
listed = null;
|
||||
listed = new Map();
|
||||
unreachable = new Map();
|
||||
}
|
||||
|
||||
// The `list-sessions` answer, shared for LIST_TTL_MS. Every open dashboard
|
||||
@@ -79,22 +149,53 @@ function __reset() {
|
||||
// own can read as live for up to a second. "No server" (exit 1) is an answer
|
||||
// too and is shared; any other failure is not.
|
||||
const LIST_TTL_MS = 1000;
|
||||
let listed = null; // { at, out } | { at, err }
|
||||
function listOutput() {
|
||||
if (listed && Date.now() - listed.at < LIST_TTL_MS) {
|
||||
if (listed.err) throw listed.err;
|
||||
return listed.out;
|
||||
let listed = new Map(); // member login ("" = ours) → { at, out } | { at, err }
|
||||
function listOutput(acct = null) {
|
||||
const key = acct ? acct.login : "";
|
||||
const hit = listed.get(key);
|
||||
if (hit && Date.now() - hit.at < LIST_TTL_MS) {
|
||||
if (hit.err) throw hit.err;
|
||||
return hit.out;
|
||||
}
|
||||
try {
|
||||
const out = String(execImpl(["list-sessions", "-F", "#{session_name}"]));
|
||||
listed = { at: Date.now(), out };
|
||||
const list = ["list-sessions", "-F", "#{session_name}"];
|
||||
let out = String(acct ? memberCall(acct, list) : execImpl(list));
|
||||
// A member's server answers for their own workspaces only: a name it
|
||||
// lists that belongs to anyone else (a server the member runs to lie
|
||||
// about another pane) is not believed.
|
||||
if (acct)
|
||||
out = out
|
||||
.split("\n")
|
||||
.filter((n) => ownedBy(n.trim(), acct))
|
||||
.join("\n");
|
||||
listed.set(key, { at: Date.now(), out });
|
||||
return out;
|
||||
} catch (err) {
|
||||
listed = err.status === 1 || err.code === "ENOENT" ? { at: Date.now(), err } : null;
|
||||
// A member's failure is shared too: a broken server of theirs is not
|
||||
// asked again on every poll.
|
||||
if (acct || err.status === 1 || err.code === "ENOENT") listed.set(key, { at: Date.now(), err });
|
||||
else listed.delete(key);
|
||||
throw err;
|
||||
}
|
||||
}
|
||||
|
||||
function ownedBy(name, acct) {
|
||||
try {
|
||||
return accountImpl(name)?.login === acct.login;
|
||||
} catch {
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
/** Our own server first, then every member's (S3). */
|
||||
function allServers() {
|
||||
try {
|
||||
return [null, ...require("./run-as").membersWithTmux()];
|
||||
} catch {
|
||||
return [null];
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Probe once, on a session that exists: `=name` failing where the bare name
|
||||
* answers means this tmux has no exact-match syntax (psmux answers
|
||||
@@ -136,14 +237,14 @@ const pane = (name) => (exact() ? `=${name}:` : name);
|
||||
|
||||
function hasSession(name) {
|
||||
try {
|
||||
execImpl(["has-session", "-t", session(name)]);
|
||||
onServerOf(name, ["has-session", "-t", session(name)]);
|
||||
return true;
|
||||
} catch {
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
/** The running tmux server's pid, or null when none answers. */
|
||||
/** Our running tmux server's pid, or null when none answers. */
|
||||
function serverPid() {
|
||||
try {
|
||||
const pid = String(execImpl(["display-message", "-p", "#{pid}"])).trim();
|
||||
@@ -172,9 +273,15 @@ function envFlags(env) {
|
||||
function newSession({ name, cwd, argv, env }) {
|
||||
// No argv = tmux's own default shell (a Windows Terminal pane).
|
||||
const cmd = argv.length ? ["--", ...argv] : [];
|
||||
listed = null;
|
||||
listed = new Map();
|
||||
const args = ["new-session", "-d", "-s", name, "-c", cwd, ...envFlags(env), ...cmd];
|
||||
if (scopeImpl && process.platform === "linux" && !serverPid()) {
|
||||
const acct = accountOf(name);
|
||||
if (acct) {
|
||||
// As the member (the first call starts their server); env and argv in
|
||||
// the launch file, never on sudo's logged command line.
|
||||
const launch = require("./run-as").launchArgv(acct, env, argv);
|
||||
memberCall(acct, ["new-session", "-d", "-s", name, "-c", cwd, "--", ...launch]);
|
||||
} else if (scopeImpl && process.platform === "linux" && !serverPid()) {
|
||||
try {
|
||||
scopeImpl(args);
|
||||
} catch {
|
||||
@@ -215,8 +322,12 @@ function enableMouse(name) {
|
||||
// so the options every tmux knows go first, in their own call. psmux (no
|
||||
// `=name` targets) is not known to chain, so it gets one call per option.
|
||||
const run = (...cmds) => {
|
||||
if (exact()) return execImpl(cmds.flatMap((c, i) => (i ? [";", ...c] : c)));
|
||||
for (const c of cmds) execImpl(c);
|
||||
if (exact())
|
||||
return onServerOf(
|
||||
name,
|
||||
cmds.flatMap((c, i) => (i ? [";", ...c] : c))
|
||||
);
|
||||
for (const c of cmds) onServerOf(name, c);
|
||||
};
|
||||
run(
|
||||
["set-option", "-t", pane(name), "mouse", "on"],
|
||||
@@ -254,8 +365,13 @@ function enableMouse(name) {
|
||||
function paneCommand(name) {
|
||||
try {
|
||||
return (
|
||||
execImpl(["display-message", "-p", "-t", pane(name), "#{pane_current_command}"]).trim() ||
|
||||
null
|
||||
onServerOf(name, [
|
||||
"display-message",
|
||||
"-p",
|
||||
"-t",
|
||||
pane(name),
|
||||
"#{pane_current_command}",
|
||||
]).trim() || null
|
||||
);
|
||||
} catch {
|
||||
return null;
|
||||
@@ -276,7 +392,21 @@ function paneCommand(name) {
|
||||
* for, so the whole class of quoting bugs goes with it.
|
||||
*/
|
||||
function sendCommand(name, argv, env, cwd) {
|
||||
execImpl([
|
||||
const acct = accountOf(name);
|
||||
if (acct) {
|
||||
const launch = require("./run-as").launchArgv(acct, env, argv);
|
||||
memberCall(acct, [
|
||||
"respawn-pane",
|
||||
"-k",
|
||||
"-t",
|
||||
pane(name),
|
||||
...(cwd ? ["-c", cwd] : []),
|
||||
"--",
|
||||
...launch,
|
||||
]);
|
||||
return;
|
||||
}
|
||||
onServerOf(name, [
|
||||
"respawn-pane",
|
||||
"-k",
|
||||
"-t",
|
||||
@@ -298,8 +428,8 @@ function sendCommand(name, argv, env, cwd) {
|
||||
* only the first line and leave the rest sitting unsent in the input box.
|
||||
*/
|
||||
function sendText(name, text) {
|
||||
execImpl(["send-keys", "-t", pane(name), "-l", text]);
|
||||
execImpl(["send-keys", "-t", pane(name), "Enter"]);
|
||||
onServerOf(name, ["send-keys", "-t", pane(name), "-l", text]);
|
||||
onServerOf(name, ["send-keys", "-t", pane(name), "Enter"]);
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -310,16 +440,18 @@ function sendText(name, text) {
|
||||
*/
|
||||
function pasteText(name, text) {
|
||||
const buf = `agenthub-paste-${name}`;
|
||||
execImpl(["set-buffer", "-b", buf, "--", text]);
|
||||
execImpl(["paste-buffer", "-p", "-d", "-b", buf, "-t", pane(name)]);
|
||||
execImpl(["send-keys", "-t", pane(name), "Enter"]);
|
||||
// A member's prompt goes in on stdin: sudo logs argv.
|
||||
if (accountOf(name)) onServerOf(name, ["load-buffer", "-b", buf, "-"], text);
|
||||
else onServerOf(name, ["set-buffer", "-b", buf, "--", text]);
|
||||
onServerOf(name, ["paste-buffer", "-p", "-d", "-b", buf, "-t", pane(name)]);
|
||||
onServerOf(name, ["send-keys", "-t", pane(name), "Enter"]);
|
||||
}
|
||||
|
||||
/** Idempotent — a session that's already gone is not an error. */
|
||||
function killSession(name) {
|
||||
listed = null;
|
||||
listed = new Map();
|
||||
try {
|
||||
execImpl(["kill-session", "-t", session(name)]);
|
||||
onServerOf(name, ["kill-session", "-t", session(name)]);
|
||||
} catch {
|
||||
/* already gone */
|
||||
}
|
||||
@@ -327,37 +459,66 @@ function killSession(name) {
|
||||
|
||||
/** Session names starting with `prefix`. Empty array if tmux has no server running at all. */
|
||||
function listSessions(prefix) {
|
||||
let out;
|
||||
try {
|
||||
out = listOutput();
|
||||
} catch {
|
||||
return [];
|
||||
const names = [];
|
||||
for (const acct of allServers()) {
|
||||
try {
|
||||
names.push(...listOutput(acct).split("\n"));
|
||||
} catch {
|
||||
/* no server there */
|
||||
}
|
||||
}
|
||||
return out
|
||||
.split("\n")
|
||||
.map((s) => s.trim())
|
||||
.filter((s) => s && s.startsWith(prefix));
|
||||
return names.map((s) => s.trim()).filter((s) => s && s.startsWith(prefix));
|
||||
}
|
||||
|
||||
/**
|
||||
* Every live session name from ONE `list-sessions` — what a poll asks instead
|
||||
* of a synchronous has-session per name, each of which blocks the event loop
|
||||
* (and so every terminal keystroke) for a whole tmux spawn. Empty when no
|
||||
* server runs (tmux exits 1) or tmux is not installed; null when the call
|
||||
* server runs (tmux exits 1) or tmux is not installed; null when OUR call
|
||||
* itself failed (EAGAIN/ENOMEM under memory pressure), which proves nothing
|
||||
* about the panes — a caller must not read that as "every pane is gone".
|
||||
* about the panes — a caller must not read that as "every pane is gone". A
|
||||
* MEMBER's server that fails (stopped, flooding, gone wrong) proves nothing
|
||||
* either, but only about that member's panes: `has` answers true for them,
|
||||
* so nobody's runs end and everyone else's are still checked.
|
||||
*/
|
||||
function liveSessions() {
|
||||
try {
|
||||
return new Set(
|
||||
listOutput()
|
||||
.split("\n")
|
||||
.map((s) => s.trim())
|
||||
.filter(Boolean)
|
||||
);
|
||||
} catch (err) {
|
||||
return err.status === 1 || err.code === "ENOENT" ? new Set() : null;
|
||||
const live = new Set();
|
||||
const unknown = new Set(); // member logins whose server did not answer
|
||||
for (const acct of allServers()) {
|
||||
try {
|
||||
for (const s of listOutput(acct).split("\n")) if (s.trim()) live.add(s.trim());
|
||||
} catch (err) {
|
||||
if (err.status === 1 || err.code === "ENOENT") continue;
|
||||
if (!acct) return null;
|
||||
unknown.add(acct.login);
|
||||
}
|
||||
}
|
||||
if (unknown.size) {
|
||||
const has = live.has.bind(live);
|
||||
live.has = (name) => has(name) || unknown.has(accountOfQuiet(name)?.login);
|
||||
}
|
||||
return live;
|
||||
}
|
||||
|
||||
function accountOfQuiet(name) {
|
||||
try {
|
||||
return accountImpl(name);
|
||||
} catch {
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* `[file, args]` attaching a terminal to a MEMBER's session (as the member,
|
||||
* sudo), or null for one on our own server (pty-attach runs our binary).
|
||||
*/
|
||||
function memberAttach(name) {
|
||||
const acct = accountOf(name);
|
||||
if (!acct) return null;
|
||||
const runAs = require("./run-as");
|
||||
return runAs.sudoArgv(acct, "tmux", [
|
||||
...["-S", runAs.tmuxSocket(acct), "attach-session", "-t", session(name)],
|
||||
]);
|
||||
}
|
||||
|
||||
function isTmuxAvailable() {
|
||||
@@ -403,6 +564,8 @@ module.exports = {
|
||||
clientVersion,
|
||||
serverVersion,
|
||||
serverPid,
|
||||
memberAttach,
|
||||
__setExecImpl,
|
||||
__setAccountImpl,
|
||||
__reset,
|
||||
};
|
||||
|
||||
Reference in New Issue
Block a user