Files

T

pastilhasandClaude Opus 5 a15fadbddc 27 tests on the file standing between a member and a shell

authorize.ts had none, and its own header is what says why that mattered: every deny path in the platform
ends there, and the failure mode of a permissive default is not a bug report, it is someone else's session.

It had none for a structural reason rather than an oversight. Every path needed two database calls, and the
only file here that mocks officerdb leaks its stub into whatever runs after it — so the obvious approach
would have traded one untested file for a flaky suite.

So the decisions are split from the fetching. resolveEffectivePermissions, decideApiRequest and
decideWsProvider are pure functions of their arguments; the async wrappers keep the role cache, the
fail-closed catches and the shape callers use. No behaviour change, and the live gate still answers 401 on
file-browser, users and tasks.

REAL registry keys throughout, deliberately: a suite built on invented permissions keeps passing after a
rename, which is the failure an authorization table can least afford. If a key here disappears this file
goes red.

Pinned beyond the happy paths — the owner carries no grants to consult; core is write unconditionally; a
confined grant is dropped without a Linux user and all three drop together; execution and admin grants in
the table are ignored even though no CHECK stops the row existing; an unknown key is ignored without
disturbing what is legitimately held; self-service is exact in method AND path; a socket needs no level; an
unauthenticated caller is refused every door.

Two gaps are stated in the file rather than left to be found: ownerOnly has no declaring permission yet, so
testing it would test the fixtures; and the grant cache's contract is a claim about call sites, not logic.

Found while writing them: readOnlyWrites paths are relative to the permission's api prefix, and getting that
wrong fails as "no permission covers this path" rather than as a level error — a misleading message for a
misleading path, now commented at the test that hit it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

2026-08-22 04:42:56 +00:00

5.4 KiB

Raw Blame History

TODO — the index

Deferred work. The items live in todo/, one file each, grouped by theme; this file is the map over them and is GENERATED — run bun run todo:index after any change rather than editing it here. Format and the two-way-sync contract: todo/README.md.

Context, corrected 2026-08-07. This list used to open by saying Officer was "collapsing from multi-tenant / open-source-ready to a single-user platform", and told you to treat multi-tenant indirection as accidental complexity. That direction was reversed. The permission model shipped on 2026-08-07 to serve a real goal — deploy to the company server, onboard people, give each one their own Gitea account through the platform. Per-user scoping is now a requirement, and the items that proposed deleting it have been removed rather than left to mislead the next reader.

What did NOT reverse: execution permissions (terminal, chat, tasks, files, desktop, browser) run as the owner's OS user and can never be granted. Indirection there really is accidental complexity.

Urgent

due 2026-08-22 — Settings to choose which server each feature uses — fleet/settings-to-choose-which-server-each-feature

Themes

84 open, 25 closed, across 29 themes.

Theme	Open	Closed
Affordances	1	0
Speaking into a session from the backend	2	0
Backburner	2	0
Background jobs	2	0
Chat interface	1	0
Code editor	1	0
Components — the shared UI layer	1	0
File watchers	1	0
Fleet — one command across every server	5	2
Headscale	0	5
Infra (alpha)	6	0
Known bugs	3	2
Mobile apps	3	0
Multi-user	16	5
Notifications	1	0
Plugin ecosystem — before it opens to third parties (2026-08-18)	3	0
Plugin infrastructure	2	0
Plugin repos — what writing their READMEs turned up	10	9
Plugin system — gaps the email extraction found (2026-08-18)	3	0
Prompt library	1	0
Settings — portable, and readable by an agent	2	0
Shell — spotlight and the dock	1	1
Sub-agents — agents spawning agents	1	1
Sudo terminal modal	1	0
Tooling — the list about the list	1	0
Transmission	6	0
URL state — routing, query strings and selection	4	0
Waiting on the owner to run it	2	0
Workspaces & Panels	2	0

Records — no items, kept for the reasoning

Newest ten

2026-08-22 A plugin's permission should be on for every role by default, off only on request — multi-user/a-plugin-s-permission-should-be-on-for-every
2026-08-22 A user's settings should export and import as a plain file — settings/a-user-s-settings-should-export-and-import-as
2026-08-22 The same for system settings, owned by the Super Admin — settings/the-same-for-system-settings-owned-by-the
2026-08-21 No way to see which affordances are reaching your agents, or to turn one off — affordances/no-way-to-see-which-affordances-are-reaching
2026-08-21 Generalise it: deliver a turn to a named session, from anywhere in the backend — agent-delivery/generalise-it-deliver-a-turn-to-a-named
2026-08-21 The cost of resuming grows with the transcript — agent-delivery/the-cost-of-resuming-grows-with-the-transcript
2026-08-21 'An agent spawned by a background job is invisible in the interface' — background-jobs/a-spawned-agent-is-invisible-in-the-interface
2026-08-21 Show how long a turn took, beside its cost and tokens — chat/show-how-long-a-turn-took-beside-its-cost
2026-08-21 Map every custom component, centralise it, and let a theme override it — components/map-every-custom-component-and-centralise-it
2026-08-21 Watch a directory, and attach actions to what lands in it — file-watchers/watch-a-directory-and-attach-actions-to-what