pastilhasandClaude Opus 5
c59df4f866
The owner authorized this explicitly. Two refusals removed together, because
they were always one guard in two places: the wholesale isSuperAdmin middleware
in api/chat/chat.ts, and the chat socket's 403 in server.tsx.
They were right for the day they stood. A turn spawned claude as the OWNER and
every transcript path resolved through the owner's home, so a granted member
would have read the owner's sessions and run an agent as them.
What replaced them, rather than what deleted them:
the turn runs as the member spawnClaudeAsMember through sudo setpriv,
proven against a real account by reading file
ownership rather than trusting the process
the credential is theirs --reset-env plus an allowlist, so the owner's
proxy variables cannot cross
the transcripts are theirs ChatIdentity carries a home from resolveHomeDir
and claude-sessions cannot invent one
the sessions are theirs every session records its owner and all six
sidecar commands refuse a mismatch
Also adds the precondition host asked for in 10: a member whose claude is not
signed in gets the instruction rather than a turn that dies on an auth error and
reads as a broken agent. Not installed and not signed in are separate messages
because they need different actions.
registry.ts and registry.test.ts now describe chat as confined in fact rather
than ahead of its implementation. The comments at both former guards say what
had to exist first, and that a revert should go back to a refusal rather than to
a narrower one.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2.4 KiB
41 — the gates are down
The owner authorized it explicitly and is signing in as green now.
Removed
api/chat/chat.ts— the wholesaleisSuperAdminrefusalserver.tsx— the chat socket's 403
Together, in one commit, because they were always one guard in two places. registry.test.ts and the chat
entry in registry.ts are updated to describe what is true rather than what was held open.
Both files keep a comment saying what replaced the refusal rather than what deleted it, and naming the four things that had to exist first: the turn runs as the member, the credential is theirs, the transcripts are theirs, the sessions record whose they are. Each of those was found wanting at least once by whichever of us had not written it. The note ends with: if you are reverting this, revert to a refusal, not to a narrower one.
Added in the same commit — the loggedIn precondition from your 10
A member whose claude is not signed in would otherwise spawn a turn, have claude exit on an auth error, and
see "the agent is broken" — the confusion /agent-status exists to prevent, arriving through a different door.
The socket now checks claudeLoginState for members and refuses with the instruction itself.
Two refusals, both member-facing sentences: not installed → ask the owner to reprovision; installed but not
signed in → run claude once in a terminal.
What to watch, since this is the first time any of it is reachable
green is signing in now, so the order tonight is: sign-in first, then a turn. If the sign-in has not completed when they try to chat, the precondition above is what they should see — and that message appearing is itself a useful result, because it proves the member path is live and the check fires.
The things I would look at first if a turn misbehaves:
- the transcript list — it should be green's own and empty, not the owner's. That is
ChatIdentity. - the cwd —
~should expand to green's home, not the owner's. /procduring a turn — theclaudeprocess should be uid 1001.- no MCP tools — deliberate: a member gets no MCP config, because the owner's carries their token. Their agent has no tools until that is designed, and an agent quietly having no tools is worth seeing rather than discovering.
tsgo clean, 75 pass, 3 skip. member is now reachable in production for the first time.