nntrivi2001
8546748759
Dependencies
- Security: body-parser and multer DoS advisories fixed (npm audit: 0).
- Server: Express 5 (query parser kept "extended", req.body defaults to {},
SPA catch-all /{*splat}, send-file helper restores Express 4's dot-folder
rule for sendFile/download, alerts ack route without inline regex),
better-sqlite3 13, js-yaml 5 (server/lib/yaml.js keeps js-yaml 4's default
schema), uuid dropped for crypto.randomUUID, node-pty beta.18, multer 2.5.
- Client: React 19, xterm 6 (WebGL renderer replaces the removed canvas one,
DOM fallback on context loss; Alt+arrow word moves re-mapped), lucide-react 1,
TypeScript 7, i18next/react-i18next/codemirror minors.
Workspace rename step 4
- `agenthub lanes` and `--lane` exit 1 with "renamed: use …"; client api.ts,
the CLI and the MCP server call /api/workspaces; /api/lanes stays mounted.
Server mode (S3): members manage their own Claude Code config
- server/lib/cc-target.js resolves whose config a /cc-config request touches
and gates the router by allowlist; /profiles* and /plugins/update-all stay
admin-only. Member writes go through write-as, CLI calls through sudo as the
member (never -y), reads through openSafe; cc_config_changed reaches only
its owner. Not verified live on an S3 install yet.
Other
- Chat: an HTML file is an artifact only when written whole and not a project
page (index.html, or under src/, public/, templates/, …).
- OpenAPI covers every /api route; openapi-coverage.test.js guards it.
- read-pool test keeps its event loop alive (its worker is unref'd).
- Docs: plan statuses, checklists, CLI.md, LANES.md, SERVER-MODE.md, API.md.
47 lines
5.6 KiB
Markdown
47 lines
5.6 KiB
Markdown
# Server mode — working checklist
|
||
|
||
Goal (2026-10-07): finish the server part — S2 ownership as proposed, review it.
|
||
|
||
- [x] S1 login, roles, `agenthub server|users` (uncommitted)
|
||
- [x] Claude account pool + balancer (uncommitted)
|
||
- [x] S2 core: `lanes.owner_id`, `server/lib/scope.js` (predicates, `scopeGuard`, broadcast audience, folder root), STAFF_ONLY_PREFIXES, pty attach check, heartbeat re-check
|
||
- [x] S2 routes: aggregates, rows, workflows (+ read worker), workspaces/runs — 4-agent workflow, each with its own test file
|
||
- [x] Bypass fix: `apiPath()` canonical path + case-insensitive rules (found by the workspaces agent)
|
||
- [x] S6 basics: `GET /api/users`, audit log (`audit_log`, `agenthub users audit`), Settings → Users, members' Settings hides staff pages
|
||
- [x] Adversarial review (5 lenses, 21 findings, each verified) and fixes: lane id coercion (1e1), PATCH run_id, array ids, POST agents/sessions, transcript path traversal (all modes), push per user, pool/quota leaks, pty re-check, CSRF origin on writes, parallel login throttle, overlapping folders, pane credential for CLI/MCP/statusline, lock namespace + lock-name path traversal (all modes), AuthGate retry/cache
|
||
- [x] Full suites: server 2532/2535 (3 lane-detect fail on a foreign process holding port 3000, same on clean HEAD), client 1074/1074; browser e2e member vs admin; docs synced
|
||
- [x] Upgrade-impact review (2026-10-07): old vs new API diff on a copy of the real DB (local mode identical but for noise), old+new builds sharing one migrated DB, 5-lens review + verify. Fixed: lock names (any single dir name ≤255, holders with spaces normalised, CLI fails fast on non-409), AuthGate rendering on an older server / DASHBOARD_TOKEN 401, pane_token_hash kept out of exports; documented the LAN origin change. Suites: server 2536/2536, client 1078/1078
|
||
- Blocked on sudo / a real host: S0 spike, S3 (one Linux user per account), S4 (shared /opt tools)
|
||
|
||
## 2026-10-08 — per-user isolation (S3/S4 + per-user proxy/plugins + Codex pool)
|
||
|
||
Decided: own Linux user per account; skills/plugins = admin baseline + user's own; AI Proxy = user's own + admin's shared (no key shown); tool binaries shared under `/opt/agenthub/tools`; Claude pool shared (exists); NEW Codex multi-account pool. Spike allowed on this machine with sudo (undo log: `/tmp/agh-spike/UNDO.sh`).
|
||
|
||
- [x] S0 spike (2026-10-08, this machine; test users agh-test1/2 kept for S3 dev, undo `/tmp/agh-spike/UNDO.sh`) → results below
|
||
- [x] Per-user AI Proxy store (+ admin shared) — S3-PLAN P1/P1b
|
||
- [x] S3 provisioning + spawn/attach as the account — S3-PLAN P2/P3
|
||
- [x] S4 shared tools in /opt — S3-PLAN P5
|
||
- [ ] Per-user skills/plugins (cc-config per account HOME, admin baseline) — seed + opt-in baseline built (P6); managed-settings spike run 2026-10-09 (works from the first interactive session, S3-PLAN P6); member Settings built 2026-10-26 ("Your Claude Code config", writes as the member) — open until verified live on the S3 box
|
||
- [x] Codex account pool — S3-PLAN P7 (fake accounts only; no real Codex login tried)
|
||
- [x] Security review, docs, suites — P8 F1–F11, second review F12–F20 (2026-10-09), docs/SERVER-MODE.md runbook
|
||
|
||
### S0 results (claude 2.1.293, codex 0.155.1, tmux 3.7c, node 26)
|
||
|
||
| Check | Result |
|
||
| --- | --- |
|
||
| Layout: `/srv/agenthub/users` 0751 root; home `<acct>:agenthub` 0750; member's own group private | GO — a member cannot list or read another home or the host's |
|
||
| claude / codex / node run from root-owned `/opt/agenthub/tools/bin` with a foreign HOME | GO — nothing written outside the home; a root-owned binary cannot self-update (plus `DISABLE_AUTOUPDATER=1`) |
|
||
| Per-account tmux server, socket in a setgid `agenthub` dir, `server-access -a <host>` + `chmod 0770` | GO — host send-keys/capture/attach work, the pane runs as the member; tmux keeps group rw across attach; another member is refused |
|
||
| Hooks as the member: `node /opt/.../hook-handler.js` → `CLAUDE_DASHBOARD_PORT` on loopback | GO — SessionStart/UserPromptSubmit arrive with the member's transcript_path |
|
||
| Codex rollouts readable by the dashboard via group | GO — 0644 under 0775 |
|
||
| Claude transcripts readable by the dashboard via group | **NO** — `.jsonl` created 0600, `sessions/` 0700; a default ACL is masked to `---`. Needs a decision |
|
||
| agy | not run (it self-updates on any run); root-owned /opt stops that |
|
||
| Host group membership | needs a new login: a running `systemd --user` keeps its old groups → server mode wants a system unit with `SupplementaryGroups=agenthub` |
|
||
| Shared Claude pool token across Linux users | setup-token is long-lived, no refresh rotation → safe |
|
||
| Codex pool with ChatGPT logins | untested (no spare account): refresh tokens rotate, so a copied `auth.json` must be copied back under a lock; API-key accounts have no such risk |
|
||
|
||
### Open decision: how the dashboard reads every tool's files (user, 2026-10-08: "all AI tools, lightest")
|
||
|
||
Proposal: server mode runs as a system unit with `AmbientCapabilities=CAP_DAC_READ_SEARCH` (read any file, no write; zero per-read cost, no per-tool code) fenced by `InaccessiblePaths=` (`/etc/shadow`, `/etc/gshadow`, `/etc/sudoers*`, `/root`, `/home`) and `NoNewPrivileges`. Every WRITE in a member's folder (git-ops, file editor, worktrees, tmux spawn) runs as the member via `sudo -u <acct>` (sudoers: host may run commands as `%agenthub-members` only, never root). Git reads need `-c safe.directory=*` (dubious-ownership check). Verification command not yet run (blocked by the agent's permission classifier — user to run it).
|
||
Code work waits until the in-flight Quit/tray/Users change-set is committed, then a new branch.
|