officerdev/platform
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

every agent session gets a key, scoped to notify

Browse Source 
a commander has officer.env and can reach the platform. an ordinary chat
agent had nothing — the only token in the tree lives in the MCP server's
environment, which the agent's own Bash cannot see. so an agent asked to
tell its owner something either could not, or asked to be handed a personal
API key: the owner's full authority, pasted into a transcript. one refused
tonight and was right to.

minted per session, permissions ['notify'], expiring in a week, named
session:<key> so re-arming replaces rather than accumulates and a survivor
is findable rather than one of a hundred identical rows.

"an agent may tell me things" is a far smaller thing to hand out than "an
agent may act as me", and it is the whole of what was being asked for.
everything else an agent needs it already has: it runs as somebody, in
their home, with their files. widening this later is one entry in an array;
starting wide and narrowing later never happens.

in the environment rather than a file, because it dies with the process:
nothing to leak, nothing to clean up after a crash, no file for a later
session to find. the commander's credential is a file for the opposite
reason — a detached loop reads it hours later.

members get it too, through the allowlist rather than round it. those
OFFICER_* names sit next to NEVER_ENV deliberately, and they are not that
kind of thing: NEVER_ENV guards the OWNER'S credentials, which would make a
member's shell more privileged than the member. this grants a member one
capability they already have, over their own devices, and nobody else's.

best effort throughout — a turn still starts if minting fails, and the
agent is simply back where it was.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Officer-Session: 656f5c85-e49a-4f1f-b9f3-042a04b4d043
This commit is contained in:
pastilhas
2026-08-25 09:06:29 +00:00
co-authored by Claude Opus 5
parent 01cecdad60
commit 538a623bb8
3 changed files with 119 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/servers/sidecar/claude/claude-manager.ts
+14
View File
@@ -11,6 +11,7 @@ import { setClaudeSession, clearClaudeSession, getClaudeSession } from './state'
import { countsAsOutput, diagnoseExit, stderrReason } from './exit-diagnosis';
import { createParseState, processMessage } from './stream-parser';
import { spawnClaudeAsMember } from './spawn-as-member';
import { mintSessionCredential } from './session-credential';
import { claudeBinIn } from '@@/os-user-claude';
const SEND_TIMEOUT_MS = 30 * 60 * 1000;
@@ -592,6 +593,19 @@ async function createSession(
// Strip the nested-session guard vars so the SDK can spawn `claude` (mirrors the old spawn env clean).
const cleanEnv = envWithoutParentSession();
/*
This session's own credential, scoped to notifications.
In the environment rather than a file: it dies with the process, there is no path to leak and nothing
to clean up after a crash. The agent's Bash inherits it as `$OFFICER_AGENT_KEY`, which is the whole
point — until now the only token in the tree was the MCP server's, which the agent's shell cannot see,
so an agent asked to tell its owner something had no door at all.
Null when minting failed. The agent then has no key, which is exactly where everything was before.
*/
const agentEnv = await mintSessionCredential(params.userId, sessionKey);
if (agentEnv) Object.assign(cleanEnv, agentEnv);
const resumeId = getClaudeSession(sessionKey, params.userId) ?? params.resumeSessionId;
/*
Where that transcript actually lives, because `--resume` is scoped to the WORKING DIRECTORY.