didericis-claude
a2edaf8694
Implements PRD prd-new-trusted-agent-forge-identity. Moves author identity and named forge configurations onto the trusted, host-only agent definition, and lets a bottle repository optionally associate a git-gate repo with one of the agent's forge aliases. - Agent-owned identity: new `author` (name/email) and `forge-accounts` (alias -> canonical Gitea /api/v1 origin + host `token_secret` ref) on the agent manifest. `author` populates the bottle's git user.name/user.email. - Remove `git-gate.user` from both agents and bottles; fail with a migration pointer to `author`. `git-gate` is no longer accepted on an agent. - Bottle git-gate repos gain optional `forge: <alias>`, resolved against the selected agent's forge-accounts at composition (fail-closed on unknown). - Fail-closed Gitea API URL validation (https, no userinfo/query/fragment, /api/v1 base, host lowercased, trailing slash normalized, host dedup). - Proxy-held credential: synthesize one inspected, token-authenticated egress route per referenced forge alias, scoped to the origin + API prefix. The token is resolved from the host env at launch into the egress proxy only — never the bottle env, prompt, gitconfig, or workspace. - Generated, non-secret forge workflow guidance appended to the agent prompt for associated repos (API base, branch-backed PR flow, AGit-ref prohibition, mutation verification); omitted when no repo declares a forge. - Agents become home-only: cwd `.bot-bottle/agents` no longer contributes, overrides, or is selectable; warned-and-ignored like cwd bottles. - Docs: README examples, PRD 0011 supersession note, manifest schema docstring. - Tests: new test_forge_identity suite; legacy git-gate.user/cwd tests updated to the agent-owned identity model. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
94 lines
2.8 KiB
Python
94 lines
2.8 KiB
Python
"""Per-agent egress (PRD 0017).
|
|
|
|
The egress gateway is a TLS-terminating forward proxy that allow-lists a
|
|
bottle's outbound HTTP(S), scans payloads for secret exfil, and injects
|
|
per-route upstream credentials the agent never sees.
|
|
|
|
Layout:
|
|
|
|
* `service` — the `Egress` host-side service (`prepare` the launch plan,
|
|
`resolve_token_values`, `agent_env_entries`) + the route-building /
|
|
rendering functions.
|
|
* `plan` — `EgressPlan` / `EgressRoute`, the launch DTOs (in the backend
|
|
contract).
|
|
|
|
The runtime enforcement (the mitmproxy addon) lives in
|
|
`bot_bottle.gateway.egress.addon*`. Public names are re-exported lazily via
|
|
`__getattr__`, so `from bot_bottle.egress import …` keeps working and importing
|
|
`egress.plan` (the contract's dependency) stays light.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
from typing import TYPE_CHECKING, Any
|
|
|
|
if TYPE_CHECKING:
|
|
from .plan import EgressPlan, EgressRoute
|
|
from .service import (
|
|
CLAUDE_HOST_CREDENTIAL_TOKEN_REF,
|
|
CODEX_HOST_CREDENTIAL_TOKEN_REF,
|
|
EGRESS_HOSTNAME,
|
|
EGRESS_ROUTES_FILENAME,
|
|
EGRESS_ROUTES_IN_CONTAINER,
|
|
Egress,
|
|
egress_agent_env_entries,
|
|
egress_forge_routes,
|
|
egress_gateway_env_entries,
|
|
egress_manifest_routes,
|
|
egress_render_routes,
|
|
egress_resolve_token_values,
|
|
egress_routes_for_bottle,
|
|
egress_token_env_map,
|
|
)
|
|
|
|
|
|
_LAZY: dict[str, str] = {
|
|
"EgressPlan": ".plan",
|
|
"EgressRoute": ".plan",
|
|
"Egress": ".service",
|
|
"CLAUDE_HOST_CREDENTIAL_TOKEN_REF": ".service",
|
|
"CODEX_HOST_CREDENTIAL_TOKEN_REF": ".service",
|
|
"EGRESS_HOSTNAME": ".service",
|
|
"EGRESS_ROUTES_FILENAME": ".service",
|
|
"EGRESS_ROUTES_IN_CONTAINER": ".service",
|
|
"egress_agent_env_entries": ".service",
|
|
"egress_forge_routes": ".service",
|
|
"egress_gateway_env_entries": ".service",
|
|
"egress_manifest_routes": ".service",
|
|
"egress_render_routes": ".service",
|
|
"egress_resolve_token_values": ".service",
|
|
"egress_routes_for_bottle": ".service",
|
|
"egress_token_env_map": ".service",
|
|
}
|
|
|
|
|
|
def __getattr__(name: str) -> Any:
|
|
src = _LAZY.get(name)
|
|
if src is None:
|
|
raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
|
|
from importlib import import_module
|
|
|
|
value = getattr(import_module(src, __name__), name)
|
|
globals()[name] = value
|
|
return value
|
|
|
|
|
|
__all__ = [
|
|
"CLAUDE_HOST_CREDENTIAL_TOKEN_REF",
|
|
"CODEX_HOST_CREDENTIAL_TOKEN_REF",
|
|
"EGRESS_HOSTNAME",
|
|
"EGRESS_ROUTES_FILENAME",
|
|
"EGRESS_ROUTES_IN_CONTAINER",
|
|
"Egress",
|
|
"EgressPlan",
|
|
"EgressRoute",
|
|
"egress_forge_routes",
|
|
"egress_manifest_routes",
|
|
"egress_render_routes",
|
|
"egress_resolve_token_values",
|
|
"egress_routes_for_bottle",
|
|
"egress_agent_env_entries",
|
|
"egress_gateway_env_entries",
|
|
"egress_token_env_map",
|
|
]
|