nntrivi2001
84e2a9f0ac
Server mode can now run each account as its own Linux user (ah-<name>) when `agenthub server install-system` has set S3 up. The dashboard reaches a member only through sudo -u / write-as / pane-launch, reads a member's files only through owner- and type-checked opens, and hooks are authenticated by peer uid. Local mode and server mode without S3 are unchanged. EXPERIMENTAL: tested with fake sudo and fake accounts only. It has not yet been verified on a real install with real member accounts, sudo or a real Codex login. Do not offer it to real users yet. - S3 core: provisioning, per-member tmux servers, the proxy key gateway, shared tools in /opt, dropped capabilities for children (P0–P5) - P4: plan and quota per member home - P6: ~/.claude.json seed; opt-in plugin baseline installed as the member; managed-settings spike script (not run) - P7: Codex account pool (`agenthub accounts add --tool codex`) - Roles merged with main's admin / analyst / developer: analysts write only their own rows, under S3 as well - Per-account prefs: one implementation (Chat UI + onboarding) - Security reviews F1–F49 (five rounds), each fix with a regression test: symlink/TOCTOU-safe member reads, no host writes in a member home, credentials and the data dir never served, owner and folder account must agree, pane tokens bound to the pane's uid, bounded sudo/tmux/git calls and member reads (no hang or crash from a member), async route rejections answer 500 instead of exiting - Docs: docs/SERVER-MODE.md (S3 model, accepted ceilings, operator runbook), docs/plans/server-mode/S3-PLAN.md, CLAUDE.md S3 rules Tests: server 2838/2841 (3 need 127.0.0.1:3000, held on this box); client 1162/1162; tsc clean; headers check passes. Co-Authored-By: Claude <noreply@anthropic.com>
5.4 KiB
5.4 KiB
Server mode — working checklist
Goal (2026-10-07): finish the server part — S2 ownership as proposed, review it.
- S1 login, roles,
agenthub server|users(uncommitted) - Claude account pool + balancer (uncommitted)
- S2 core:
lanes.owner_id,server/lib/scope.js(predicates,scopeGuard, broadcast audience, folder root), STAFF_ONLY_PREFIXES, pty attach check, heartbeat re-check - S2 routes: aggregates, rows, workflows (+ read worker), workspaces/runs — 4-agent workflow, each with its own test file
- Bypass fix:
apiPath()canonical path + case-insensitive rules (found by the workspaces agent) - S6 basics:
GET /api/users, audit log (audit_log,agenthub users audit), Settings → Users, members' Settings hides staff pages - Adversarial review (5 lenses, 21 findings, each verified) and fixes: lane id coercion (1e1), PATCH run_id, array ids, POST agents/sessions, transcript path traversal (all modes), push per user, pool/quota leaks, pty re-check, CSRF origin on writes, parallel login throttle, overlapping folders, pane credential for CLI/MCP/statusline, lock namespace + lock-name path traversal (all modes), AuthGate retry/cache
- Full suites: server 2532/2535 (3 lane-detect fail on a foreign process holding port 3000, same on clean HEAD), client 1074/1074; browser e2e member vs admin; docs synced
- Upgrade-impact review (2026-10-07): old vs new API diff on a copy of the real DB (local mode identical but for noise), old+new builds sharing one migrated DB, 5-lens review + verify. Fixed: lock names (any single dir name ≤255, holders with spaces normalised, CLI fails fast on non-409), AuthGate rendering on an older server / DASHBOARD_TOKEN 401, pane_token_hash kept out of exports; documented the LAN origin change. Suites: server 2536/2536, client 1078/1078
- Blocked on sudo / a real host: S0 spike, S3 (one Linux user per account), S4 (shared /opt tools)
2026-10-08 — per-user isolation (S3/S4 + per-user proxy/plugins + Codex pool)
Decided: own Linux user per account; skills/plugins = admin baseline + user's own; AI Proxy = user's own + admin's shared (no key shown); tool binaries shared under /opt/agenthub/tools; Claude pool shared (exists); NEW Codex multi-account pool. Spike allowed on this machine with sudo (undo log: /tmp/agh-spike/UNDO.sh).
- S0 spike (2026-10-08, this machine; test users agh-test1/2 kept for S3 dev, undo
/tmp/agh-spike/UNDO.sh) → results below - Per-user AI Proxy store (+ admin shared) — S3-PLAN P1/P1b
- S3 provisioning + spawn/attach as the account — S3-PLAN P2/P3
- S4 shared tools in /opt — S3-PLAN P5
- Per-user skills/plugins (cc-config per account HOME, admin baseline) — seed + opt-in baseline built (P6); managed-settings spike not run, member Settings not built
- Codex account pool — S3-PLAN P7 (fake accounts only; no real Codex login tried)
- Security review, docs, suites — P8 F1–F11, second review F12–F20 (2026-10-09), docs/SERVER-MODE.md runbook
S0 results (claude 2.1.293, codex 0.155.1, tmux 3.7c, node 26)
| Check | Result |
|---|---|
Layout: /srv/agenthub/users 0751 root; home <acct>:agenthub 0750; member's own group private |
GO — a member cannot list or read another home or the host's |
claude / codex / node run from root-owned /opt/agenthub/tools/bin with a foreign HOME |
GO — nothing written outside the home; a root-owned binary cannot self-update (plus DISABLE_AUTOUPDATER=1) |
Per-account tmux server, socket in a setgid agenthub dir, server-access -a <host> + chmod 0770 |
GO — host send-keys/capture/attach work, the pane runs as the member; tmux keeps group rw across attach; another member is refused |
Hooks as the member: node /opt/.../hook-handler.js → CLAUDE_DASHBOARD_PORT on loopback |
GO — SessionStart/UserPromptSubmit arrive with the member's transcript_path |
| Codex rollouts readable by the dashboard via group | GO — 0644 under 0775 |
| Claude transcripts readable by the dashboard via group | NO — .jsonl created 0600, sessions/ 0700; a default ACL is masked to ---. Needs a decision |
| agy | not run (it self-updates on any run); root-owned /opt stops that |
| Host group membership | needs a new login: a running systemd --user keeps its old groups → server mode wants a system unit with SupplementaryGroups=agenthub |
| Shared Claude pool token across Linux users | setup-token is long-lived, no refresh rotation → safe |
| Codex pool with ChatGPT logins | untested (no spare account): refresh tokens rotate, so a copied auth.json must be copied back under a lock; API-key accounts have no such risk |
Open decision: how the dashboard reads every tool's files (user, 2026-10-08: "all AI tools, lightest")
Proposal: server mode runs as a system unit with AmbientCapabilities=CAP_DAC_READ_SEARCH (read any file, no write; zero per-read cost, no per-tool code) fenced by InaccessiblePaths= (/etc/shadow, /etc/gshadow, /etc/sudoers*, /root, /home) and NoNewPrivileges. Every WRITE in a member's folder (git-ops, file editor, worktrees, tmux spawn) runs as the member via sudo -u <acct> (sudoers: host may run commands as %agenthub-members only, never root). Git reads need -c safe.directory=* (dubious-ownership check). Verification command not yet run (blocked by the agent's permission classifier — user to run it).
Code work waits until the in-flight Quit/tray/Users change-set is committed, then a new branch.