nntrivi2001
84e2a9f0ac
Server mode can now run each account as its own Linux user (ah-<name>) when `agenthub server install-system` has set S3 up. The dashboard reaches a member only through sudo -u / write-as / pane-launch, reads a member's files only through owner- and type-checked opens, and hooks are authenticated by peer uid. Local mode and server mode without S3 are unchanged. EXPERIMENTAL: tested with fake sudo and fake accounts only. It has not yet been verified on a real install with real member accounts, sudo or a real Codex login. Do not offer it to real users yet. - S3 core: provisioning, per-member tmux servers, the proxy key gateway, shared tools in /opt, dropped capabilities for children (P0–P5) - P4: plan and quota per member home - P6: ~/.claude.json seed; opt-in plugin baseline installed as the member; managed-settings spike script (not run) - P7: Codex account pool (`agenthub accounts add --tool codex`) - Roles merged with main's admin / analyst / developer: analysts write only their own rows, under S3 as well - Per-account prefs: one implementation (Chat UI + onboarding) - Security reviews F1–F49 (five rounds), each fix with a regression test: symlink/TOCTOU-safe member reads, no host writes in a member home, credentials and the data dir never served, owner and folder account must agree, pane tokens bound to the pane's uid, bounded sudo/tmux/git calls and member reads (no hang or crash from a member), async route rejections answer 500 instead of exiting - Docs: docs/SERVER-MODE.md (S3 model, accepted ceilings, operator runbook), docs/plans/server-mode/S3-PLAN.md, CLAUDE.md S3 rules Tests: server 2838/2841 (3 need 127.0.0.1:3000, held on this box); client 1162/1162; tsc clean; headers check passes. Co-Authored-By: Claude <noreply@anthropic.com>
39 lines
1.4 KiB
JavaScript
39 lines
1.4 KiB
JavaScript
/**
|
|
* @file Thin execFile wrapper around the GitHub CLI (`gh`), used by
|
|
* server/lib/ci-status.js to read Actions run state. Mirrors worktree.js's
|
|
* git() helper's shape (cwd-scoped, throws with structured .gh details on
|
|
* failure) but has no env-scrubbing to do — gh doesn't read GIT_* variables.
|
|
* @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
|
|
*/
|
|
|
|
const { execFile } = require("node:child_process");
|
|
const { promisify } = require("node:util");
|
|
|
|
const execFileAsync = promisify(execFile);
|
|
|
|
/**
|
|
* Run `gh <args>` in `cwd`. Resolves `{ stdout, stderr }` on a zero exit.
|
|
* On failure, throws an Error with `.gh = { args, code, stderr }` — `.code`
|
|
* is `"ENOGH"` when the binary itself is missing, otherwise the process's
|
|
* exit code.
|
|
*
|
|
* @param {string} cwd
|
|
* @param {string[]} args
|
|
* @returns {Promise<{stdout: string, stderr: string}>}
|
|
*/
|
|
async function gh(cwd, args) {
|
|
try {
|
|
// As the folder's member under S3 (their own `gh auth`, their repository).
|
|
const [cmd, argv] = require("./run-as").commandIn(cwd, "gh", args);
|
|
const result = await execFileAsync(cmd, argv, { cwd, maxBuffer: 8 * 1024 * 1024 });
|
|
return { stdout: result.stdout, stderr: result.stderr };
|
|
} catch (err) {
|
|
const error = new Error(`gh ${args[0]} failed`);
|
|
error.code = err.code === "ENOENT" ? "ENOGH" : err.code;
|
|
error.gh = { args, code: err.code, stderr: err.stderr || "" };
|
|
throw error;
|
|
}
|
|
}
|
|
|
|
module.exports = { gh };
|