officerdev/platform
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

remove the dead multi-user surface

Browse Source 
Officer is single-user: the server owner is the only account, created once by
/auth/bootstrap. Everything that existed to serve additional users was
unreachable, so it is gone rather than left looking like it does something.

Accounts: drop the invite / resend-invite / delete / list-users routes and the
Users settings screen, the inert /auth/signup handler, and the account
verification chain it fed (verify, resend-verification, VerifyScreen, the
UserInvite + VerifyAdmin + VerifyRegistration templates). /auth/verify-token
survives for password resets only, and now requires a reset-password token
rather than accepting any signed JWT.

Roles: drop the users.role column and the four-value USER_ROLES enum. The
permissions table granted every role identical methods, and every
role === 'Super Admin' check was permanently true. The JWT no longer carries a
role claim.

Sandbox: remove sidecar/sandbox.ts and its five call sites. bwrap was selected
only for non-Super-Admin users, so it never ran. It was also not a usable agent
jail as written — --share-net, the project root (with .env) bound read-only,
and runuser dropping to the server's own uid. Rebuilding it for agent
containment would be a different construction, and git history keeps this one.

getHomeDir keeps its DATA_PATH meaning; the new getOwnerHomeDir resolves the
owner's real login home, which is what terminals, chats and task runs use.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
brunorezio
2026-07-25 23:30:20 +01:00
co-authored by Claude Opus 5
parent 92de996412
commit 044aacf4d5
85 changed files with 2761 additions and 2121 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/servers/sidecar/claude/claude-manager.ts
+11 -27
View File
@@ -2,7 +2,6 @@ import { join } from 'node:path';
import type { Subprocess } from 'bun';
import type { ChatEvent } from '../../api/chat/types';
import type { ClaudeSpawnParams, ClaudeSpawnStreamingParams, ClaudeCodeResult } from '../protocol';
import { buildSandboxPrefix, buildRunuserSuffix, SANDBOX_HOME } from '../sandbox';
import { setClaudeSession, clearClaudeSession, getClaudeSession } from './state';
import { parseStream } from './stream-parser';
@@ -16,26 +15,13 @@ const CLAUDE_BIN = '/usr/local/bin/claude';
const HOST_HOME = process.env.HOME!;
const DATA_PATH = process.env.DATA_PATH ?? join(process.cwd(), 'data');
// Build full bwrap sandbox args for Claude (prefix + Anthropic env + runuser suffix)
function buildSandboxArgs(email: string): string[] {
const prefix = buildSandboxPrefix(email);
// Claude-specific env vars
if (process.env.ANTHROPIC_BASE_URL) prefix.push('--setenv', 'ANTHROPIC_BASE_URL', process.env.ANTHROPIC_BASE_URL);
if (process.env.ANTHROPIC_API_KEY) prefix.push('--setenv', 'ANTHROPIC_API_KEY', process.env.ANTHROPIC_API_KEY);
return [...prefix, ...buildRunuserSuffix()];
}
// Active streaming processes
const activeProcs = new Map<string, Subprocess>();
// MCP config paths, set by user-instance at startup
let mcpSandboxPath: string | undefined; // path inside bwrap sandbox (/data/...)
let mcpHostPath: string | undefined; // path on the host filesystem
export function setMcpConfigPath(sandboxPath: string, hostPath: string): void {
mcpSandboxPath = sandboxPath;
export function setMcpConfigPath(hostPath: string): void {
mcpHostPath = hostPath;
}
@@ -57,8 +43,7 @@ export async function spawnClaude(params: ClaudeSpawnParams): Promise<ClaudeCode
const claudeArgs = [CLAUDE_BIN, '-p', prompt, '--dangerously-skip-permissions', '--output-format', 'json'];
const isSuperAdmin = params.role === 'Super Admin';
const mcpConfig = isSuperAdmin ? mcpHostPath : mcpSandboxPath;
const mcpConfig = mcpHostPath;
if (mcpConfig) claudeArgs.push('--mcp-config', mcpConfig);
const subModel = params.model?.split('/')[1];
@@ -68,10 +53,10 @@ export async function spawnClaude(params: ClaudeSpawnParams): Promise<ClaudeCode
claudeArgs.push('--resume', existingSession);
}
const spawnCmd = isSuperAdmin ? claudeArgs : [...buildSandboxArgs(email), ...claudeArgs];
// Honor a caller-provided working directory (e.g. /chat runs from a dedicated general_chat_sessions dir);
// fall back to the host home for Super Admin, or the sandbox default otherwise.
const spawnCwd = isSuperAdmin ? (params.cwd ?? HOST_HOME) : undefined;
const spawnCmd = claudeArgs;
// Honor a caller-provided working directory (e.g. /chat runs from a dedicated general_chat_sessions
// dir); fall back to the owner's host home.
const spawnCwd = params.cwd ?? HOST_HOME;
const proc = Bun.spawn(spawnCmd, {
stdin: 'pipe',
@@ -156,8 +141,7 @@ export async function spawnClaudeStreaming(
];
const { CLAUDECODE: _, ...cleanEnv } = process.env;
const isSuperAdmin = params.role === 'Super Admin';
const mcpConfig = isSuperAdmin ? mcpHostPath : mcpSandboxPath;
const mcpConfig = mcpHostPath;
if (mcpConfig) claudeArgs.push('--mcp-config', mcpConfig);
const subModel = params.model?.split('/')[1];
@@ -171,10 +155,10 @@ export async function spawnClaudeStreaming(
if (!existingSession) setClaudeSession(sessionKey, resumeId);
}
const spawnCmd = isSuperAdmin ? claudeArgs : [...buildSandboxArgs(email), ...claudeArgs];
// Honor a caller-provided working directory (e.g. /chat runs from a dedicated general_chat_sessions dir);
// fall back to the host home for Super Admin, or the sandbox default otherwise.
const spawnCwd = isSuperAdmin ? (params.cwd ?? HOST_HOME) : undefined;
const spawnCmd = claudeArgs;
// Honor a caller-provided working directory (e.g. /chat runs from a dedicated general_chat_sessions
// dir); fall back to the owner's host home.
const spawnCwd = params.cwd ?? HOST_HOME;
const proc = Bun.spawn(spawnCmd, {
stdin: 'ignore',