novox/mesh-catalog
7
0
Fork 0
Code Issues Pull Requests 6 Actions Packages Projects Releases Wiki Activity

claude-code: write the agent's home as its own account where it has one

Browse Source 
On the control node agents are to run as an account that cannot become root
(hq ADR 0266). The runtime keeps running as the operator, so the token, the
identity and the home-scope items go to the agent's home through a helper
started as that account; the licence and the account file follow the move,
what was placed in the operator's home goes once the agent holds the licence,
and the guard refuses every tool of a session running as anyone else,
recording to the journal. An API key is taken only from the agent's home and
only when it is one, here and in the licence manager, so the tool cannot carry
off the runtime's credential. Unchanged where no agent account is named.
This commit is contained in:
jochen
2026-10-09 10:14:18 +02:00
parent 7339ce8556
commit b57e6e8144
17 changed files with 1467 additions and 102 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/claude-code/cmd/claude-code/grant.go
+4 -5
View File
@@ -15,7 +15,6 @@ import (
"bytes"
"encoding/json"
"math"
"os"
"path/filepath"
)
@@ -72,7 +71,7 @@ func (c Credentials) oauth() map[string]any {
// ReadCredentials reads the file, keeping numbers as written; nil when there is none.
func ReadCredentials(path string) Credentials {
raw, err := os.ReadFile(path)
raw, err := fsys.ReadFile(path)
if err != nil {
return nil
}
@@ -172,7 +171,7 @@ func ReplacedBy(local Credentials, g Grant) Credentials {
// WriteCredentials writes atomically at 0600: a partial credentials file must never be read as a whole one.
func WriteCredentials(path string, c Credentials) error {
if err := os.MkdirAll(filepath.Dir(path), 0o700); err != nil {
if err := fsys.MkdirAll(filepath.Dir(path), 0o700); err != nil {
return err
}
raw, err := indented(c)
@@ -180,10 +179,10 @@ func WriteCredentials(path string, c Credentials) error {
return err
}
tmp := path + ".mesh-tmp"
if err := os.WriteFile(tmp, raw, 0o600); err != nil {
if err := fsys.WriteFile(tmp, raw, 0o600); err != nil {
return err
}
return os.Rename(tmp, path)
return fsys.Rename(tmp, path)
}
// indented is JSON as the agent's own files are written: two-space indent, a trailing newline, nothing