4 Commits

Include renames

Author	SHA1	Message	Date
jochen	b240085e0a	Close the review's gaps round the agent account (hq ADR 0266) ... The managed settings apply to every account's claude, so a key-helper script under the agent's home would run as the operator, and through sudo as root: the command is now carried whole in the root-owned managed settings and reads the key only as the agent. The helper reads only a regular file, bounded, without blocking, and a request it does not answer fails in time instead of holding every later one; a directory entry it answers that is not a name is refused. The guard's record is matched on its binary in the query, a half-named agent account is not taken as the operator's, the kept API key stays until the agent's home holds one, restic refuses to restore beside a directory others may write, and the agent-home check cleans a path before judging it.	2026-10-09 23:48:15 +02:00
jochen	b57e6e8144	claude-code: write the agent's home as its own account where it has one ... On the control node agents are to run as an account that cannot become root (hq ADR 0266). The runtime keeps running as the operator, so the token, the identity and the home-scope items go to the agent's home through a helper started as that account; the licence and the account file follow the move, what was placed in the operator's home goes once the agent holds the licence, and the guard refuses every tool of a session running as anyone else, recording to the journal. An API key is taken only from the agent's home and only when it is one, here and in the licence manager, so the tool cannot carry off the runtime's credential. Unchanged where no agent account is named.	2026-10-09 10:14:18 +02:00
jochen	f72a435487	claude-code: read where it runs from the controller's JSON answer ... nodesRunningMe looked for printed lines in what is a JSON list, so every register tool's "also on" hint and every nodes: "all" named no machine.	2026-10-07 20:28:06 +02:00
jochen	24a3fac2ba	claude-code: point the agent at the mesh's tools and guard its shell against ssh to the mesh (hq ADR 0245) ... The agent kept running ssh <machine> journalctl while the journal verb existed. The managed instructions now carry an "instead of" table generated from what each verb says it replaces, and the plugin carries a PreToolUse guard that refuses ssh to a mesh machine and local work-arounds for a mesh name, naming the tool or saying one must be created. The operator's override is read from the session's start environment and recorded.	2026-10-07 20:27:31 +02:00