jochen
b57e6e8144
On the control node agents are to run as an account that cannot become root (hq ADR 0266). The runtime keeps running as the operator, so the token, the identity and the home-scope items go to the agent's home through a helper started as that account; the licence and the account file follow the move, what was placed in the operator's home goes once the agent holds the licence, and the guard refuses every tool of a session running as anyone else, recording to the journal. An API key is taken only from the agent's home and only when it is one, here and in the licence manager, so the tool cannot carry off the runtime's credential. Unchanged where no agent account is named.
14 lines
554 B
Plaintext
14 lines
554 B
Plaintext
node_modules/
|
|
dist/
|
|
|
|
# Go tool bundles built in place (go build in a module's cmd/<name>-tools) are build output.
|
|
modules/slack/cmd/slack-tools/slack-tools
|
|
modules/jetbrains-toolbox/cmd/toolbox-tools/toolbox-tools
|
|
modules/messenger/cmd/messenger/messenger
|
|
modules/mesh-watcher/cmd/mesh-watcher/mesh-watcher
|
|
modules/claude-code/cmd/claude-code/claude-code
|
|
# ...and the same built from the module's root (go build ./cmd/<name>), which names it after the module.
|
|
modules/messenger/messenger
|
|
modules/claude-code/claude-code
|
|
modules/mesh-watcher/mesh-watcher
|