4 Commits

Author	SHA1	Message	Date
didericis-claude	4199de5e3e	feat(claude): add forward_host_credentials support ... Reads the host's Claude OAuth session key from ~/.claude.json at launch and forwards it only to the egress sidecar (never to the agent), placing a placeholder CLAUDE_CODE_OAUTH_TOKEN in the agent env so Claude Code starts without seeing the real credential. Mirrors the existing Codex forward_host_credentials flow (PRD 0029). Adds claude_auth.py to extract and validate the sessionKey, a CLAUDE_HOST_CREDENTIAL_TOKEN_REF constant in egress.py, and updates manifest_agent.py to allow the flag for both 'codex' and 'claude' templates. Also adds a mutual-exclusion check that rejects setting both auth_token and forward_host_credentials together. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> fix(claude): read credentials from ~/.claude/.credentials.json The actual OAuth token is in ~/.claude/.credentials.json under claudeAiOauth.accessToken, not in ~/.claude.json. ~/.claude.json holds only UI state and profile metadata (oauthAccount has no token fields). expiresAt in the credentials file is milliseconds, not seconds. Discovered after testing against Claude Code 2.1.198. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> fix(claude): fall back to macOS Keychain for credentials On macOS, Claude Code stores credentials in the Keychain under service "Claude Code-credentials" rather than in a file. When ~/.claude/.credentials.json is absent, shell out to: security find-generic-password -s "Claude Code-credentials" -w and parse the result as the same JSON schema. ~/.claude.json holds only profile/UI metadata (oauthAccount has no token fields). expiresAt in the credentials is milliseconds. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> docs(prd): fix credential path references (~/.claude/.credentials.json) fix(test): suppress gitleaks false positives on synthetic Claude tokens	2026-07-21 13:15:05 -04:00
didericis	36e62cd7e8	test: add unit tests to pass diff-coverage gate (91%) ... Cover the new production lines added on this branch: - cli/__init__: MissingEnvVarError maps to return 1 - cli/start: no-agents-defined path, prepare_with_preflight calls render_preflight, _text_render_preflight backend name output - env: resolve_env raises MissingEnvVarError for missing interpolated var - smolmachines/launch: _proxy_host Linux/non-Linux branches, _discover_urls git-gate host and supervise URL stamping Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-09 00:19:24 -04:00
didericis	94eca35b4f	fix(skills): validate skill names and quote provisioning paths ... Skill names become host/guest path segments interpolated into the `bottle.exec` shell strings in each contrib provider's provision_skills. They were validated only as strings, so a name with shell metacharacters or path traversal could reach the command. Layer two defenses: - Primary: reject any skill name that isn't kebab-case ([a-z][a-z0-9-]*) at manifest load, reusing the convention already enforced on bottle/agent filenames (new is_valid_entity_name helper in manifest_schema). Fails loud and early, protecting every consumer of the name — not just the exec call sites. - Failsafe: shlex.quote the interpolated skills_dir / dst paths in the claude, codex, and pi providers, so a future unvalidated field can't inject shell metacharacters even if it bypasses the load-time check. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NkwFXLFff9PYPy4wgVBJp9	2026-06-27 02:15:30 -04:00
didericis	74060192e0	test(manifest): ratchet manifest + manifest_agent to >=90% ... Fifth per-module ratchet under ADR 0004. Drive the validation rejection and edge paths: - ManifestBottle.from_dict: unknown key, non-string env value, non-bool supervise, removed `runtime` field. - ManifestAgentProvider.from_dict: unknown key, empty template, non-string dockerfile, auth_token / forward_host_credentials template constraints. - _parse_provider_settings: pass-through for non-built-in templates, startup_args shape, and the pi-specific string/int/bool/models/ max_tokens_field/api-key-conflict checks. - ManifestAgent.from_dict: bottle empty/undefined, skills shape, prompt type, agent-level git-gate.repos rejection, empty git-gate allowed. - Eager ManifestIndex: empty bottles section, unknown-agent load, has_agent / require_agent, git_identity_summary (set and empty). manifest_agent.py: 84% -> 99%; manifest.py: 86% -> 94%. Remaining manifest.py misses are the lazy on-disk loader paths exercised by the integration suite. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NkwFXLFff9PYPy4wgVBJp9	2026-06-25 22:15:07 -04:00