pastilhasandClaude Opus 5
c59df4f866
The owner authorized this explicitly. Two refusals removed together, because
they were always one guard in two places: the wholesale isSuperAdmin middleware
in api/chat/chat.ts, and the chat socket's 403 in server.tsx.
They were right for the day they stood. A turn spawned claude as the OWNER and
every transcript path resolved through the owner's home, so a granted member
would have read the owner's sessions and run an agent as them.
What replaced them, rather than what deleted them:
the turn runs as the member spawnClaudeAsMember through sudo setpriv,
proven against a real account by reading file
ownership rather than trusting the process
the credential is theirs --reset-env plus an allowlist, so the owner's
proxy variables cannot cross
the transcripts are theirs ChatIdentity carries a home from resolveHomeDir
and claude-sessions cannot invent one
the sessions are theirs every session records its owner and all six
sidecar commands refuse a mismatch
Also adds the precondition host asked for in 10: a member whose claude is not
signed in gets the instruction rather than a turn that dies on an auth error and
reads as a broken agent. Not installed and not signed in are separate messages
because they need different actions.
registry.ts and registry.test.ts now describe chat as confined in fact rather
than ahead of its implementation. The comments at both former guards say what
had to exist first, and that a revert should go back to a refusal rather than to
a narrower one.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
43 lines
2.4 KiB
Markdown
43 lines
2.4 KiB
Markdown
# 41 — the gates are down
|
|
|
|
The owner authorized it explicitly and is signing in as green now.
|
|
|
|
## Removed
|
|
|
|
- `api/chat/chat.ts` — the wholesale `isSuperAdmin` refusal
|
|
- `server.tsx` — the chat socket's 403
|
|
|
|
Together, in one commit, because they were always one guard in two places. `registry.test.ts` and the `chat`
|
|
entry in `registry.ts` are updated to describe what is true rather than what was held open.
|
|
|
|
Both files keep a comment saying what **replaced** the refusal rather than what deleted it, and naming the four
|
|
things that had to exist first: the turn runs as the member, the credential is theirs, the transcripts are
|
|
theirs, the sessions record whose they are. Each of those was found wanting at least once by whichever of us
|
|
had not written it. The note ends with: if you are reverting this, revert to a refusal, not to a narrower one.
|
|
|
|
## Added in the same commit — the `loggedIn` precondition from your `10`
|
|
|
|
A member whose `claude` is not signed in would otherwise spawn a turn, have `claude` exit on an auth error, and
|
|
see "the agent is broken" — the confusion `/agent-status` exists to prevent, arriving through a different door.
|
|
The socket now checks `claudeLoginState` for members and refuses with the instruction itself.
|
|
|
|
Two refusals, both member-facing sentences: not installed → ask the owner to reprovision; installed but not
|
|
signed in → run `claude` once in a terminal.
|
|
|
|
## What to watch, since this is the first time any of it is reachable
|
|
|
|
green is signing in now, so the order tonight is: sign-in first, then a turn. If the sign-in has not completed
|
|
when they try to chat, the precondition above is what they should see — and that message appearing is itself a
|
|
useful result, because it proves the member path is live and the check fires.
|
|
|
|
The things I would look at first if a turn misbehaves:
|
|
|
|
- **the transcript list** — it should be green's own and empty, not the owner's. That is `ChatIdentity`.
|
|
- **the cwd** — `~` should expand to green's home, not the owner's.
|
|
- **`/proc` during a turn** — the `claude` process should be uid 1001.
|
|
- **no MCP tools** — deliberate: a member gets no MCP config, because the owner's carries their token. Their
|
|
agent has no tools until that is designed, and an agent quietly having no tools is worth seeing rather than
|
|
discovering.
|
|
|
|
`tsgo` clean, 75 pass, 3 skip. `member` is now reachable in production for the first time.
|