nntrivi2001
84e2a9f0ac
Server mode can now run each account as its own Linux user (ah-<name>) when `agenthub server install-system` has set S3 up. The dashboard reaches a member only through sudo -u / write-as / pane-launch, reads a member's files only through owner- and type-checked opens, and hooks are authenticated by peer uid. Local mode and server mode without S3 are unchanged. EXPERIMENTAL: tested with fake sudo and fake accounts only. It has not yet been verified on a real install with real member accounts, sudo or a real Codex login. Do not offer it to real users yet. - S3 core: provisioning, per-member tmux servers, the proxy key gateway, shared tools in /opt, dropped capabilities for children (P0–P5) - P4: plan and quota per member home - P6: ~/.claude.json seed; opt-in plugin baseline installed as the member; managed-settings spike script (not run) - P7: Codex account pool (`agenthub accounts add --tool codex`) - Roles merged with main's admin / analyst / developer: analysts write only their own rows, under S3 as well - Per-account prefs: one implementation (Chat UI + onboarding) - Security reviews F1–F49 (five rounds), each fix with a regression test: symlink/TOCTOU-safe member reads, no host writes in a member home, credentials and the data dir never served, owner and folder account must agree, pane tokens bound to the pane's uid, bounded sudo/tmux/git calls and member reads (no hang or crash from a member), async route rejections answer 500 instead of exiting - Docs: docs/SERVER-MODE.md (S3 model, accepted ceilings, operator runbook), docs/plans/server-mode/S3-PLAN.md, CLAUDE.md S3 rules Tests: server 2838/2841 (3 need 127.0.0.1:3000, held on this box); client 1162/1162; tsc clean; headers check passes. Co-Authored-By: Claude <noreply@anthropic.com>
46 lines
3.0 KiB
Markdown
46 lines
3.0 KiB
Markdown
# First-run setup and tour (per account)
|
|
|
|
Asked 2026-10-08 (modelled on Orca's 3-step welcome). Decisions:
|
|
|
|
- **Bypass is never remembered** (CLAUDE.md rule). The wizard remembers a default *permission mode* (Auto / Accept edits / Ask / Plan); bypass stays the red per-session switch.
|
|
- **Per account, on the server.** The choices follow the account to any browser. Local mode is one account, `local`.
|
|
- **The tutorial is a step-by-step spotlight tour.**
|
|
|
|
## Server
|
|
|
|
- [x] The `user_prefs` table: `user_key` (`u<id>`, or `local`), `prefs` (JSON), `onboarded_at`, `updated_at`. It is migration-safe (`CREATE IF NOT EXISTS`).
|
|
- [x] `server/routes/me.js`, mounted at `/api/me`:
|
|
- `GET /prefs` returns `{prefs, onboardedAt}`;
|
|
- `PUT /prefs` merges `{prefs}`, takes only keys in `PREF_KEYS`, string values of at most 8 KB each, and `null` deletes a key;
|
|
- `POST /onboarded` marks the account as onboarded.
|
|
- Writes are same-origin. A member may write their own prefs, and nobody else's.
|
|
- [x] S3: when a member saves a mode, the theme in their Claude Code `~/.claude/settings.json` follows it (dark or light), written through `write-as`.
|
|
- [x] P6: `agenthub-provision create` seeds the member's `~/.claude.json` with `hasCompletedOnboarding` and trust for the home folder. It runs as the member (`runuser` + the shared node). Verified: trusting the home also covers folders under it.
|
|
|
|
## Client
|
|
|
|
- [x] `lib/userPrefs.ts`:
|
|
- **On login:** hydrate localStorage from the server, then re-apply the theme, language and pet.
|
|
- **On save:** wrapping `localStorage.setItem` for `PREF_KEYS` pushes each change (debounced).
|
|
- [x] New preference keys:
|
|
- `agenthub.defaultTool`, read by AddLaneModal before the install default;
|
|
- `agenthub.permissionMode`, read by WorkspaceHome. `bypassPermissions` is never accepted here.
|
|
- [x] `components/onboarding/OnboardingWizard.tsx`, mounted in Layout. It shows when the account is not onboarded AND has no workspace (an account that already has one is marked onboarded silently). Steps:
|
|
1. Default agent (detected tools as a grid, plus "show more") and the default permission mode.
|
|
2. Appearance: System, Dark and Light as preview cards, a theme grid for dark and for light below them, then language and terminal font.
|
|
3. Pet: none or an installed pet, and its size.
|
|
4. Notifications: enable, sound and preview, send a test.
|
|
|
|
The footer has Skip, Back and Continue (Ctrl+Enter). The last step's button is "Add your first workspace", which starts the tour.
|
|
- [x] `components/onboarding/Tour.tsx`: a spotlight on `data-tour` targets. Each step moves on when its condition holds, and the step reached is saved in prefs (`agenthub.tour`). The steps:
|
|
- Add workspace
|
|
- the folder field
|
|
- Create
|
|
- the prompt box
|
|
- sending the prompt
|
|
- the session pane
|
|
- done
|
|
- [x] "Run setup again" lives in Settings → Appearance (every account can open it; System is not a member's page).
|
|
- [x] i18n in English and Vietnamese. Tests: the server route; the client wizard, tour and prefs; snapshots.
|
|
- [x] Docs: `docs/API.md`, `docs/SERVER-MODE.md` and the CLAUDE.md marker.
|