fix(report): 为主编排回注补充 IPC 鉴权 - #779
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f7e7320290
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| let response: Response; | ||
| try { | ||
| response = await fetch(`http://127.0.0.1:${daemon.ipcPort}/api/trigger`, { | ||
| response = await fetchDaemonIpc(daemon.ipcPort, '/api/trigger', { |
There was a problem hiding this comment.
On Linux hosts with device credential isolation enabled but the per-bot file sandbox disabled, the credential-only bwrap wrapper deliberately masks .dashboard-secret while leaving the dispatch registry and daemon descriptors readable. This branch is therefore reachable, but fetchDaemonIpc calls loadDaemonIpcSecret() before sending anything and throws, so every registry-backed botmux report still fails instead of reaching the orchestrator. Use a daemon-side relay or a session-scoped capability path rather than requiring the agent process to read the host HMAC secret.
AGENTS.md reference: AGENTS.md:L54-L58
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
已修复。credential-isolated CLI 不再读取 host HMAC：它改为携带当前轮换的 session capability 请求 source daemon 的 /api/report-relay。该 handler 会绑定 live session / turn / dispatch root，从宿主 registry 派生目标身份，并由 daemon 使用 HMAC 转发固定的 untrusted report envelope；调用方提交的 source/target 字段不会被信任。补充的授权与 wiring 回归覆盖了缺失、错误、过期 capability，跨 root/turn、身份夹带、receiver 拒绝和 256 KiB body limit；相关 323/323 测试及 pnpm build 均通过。修复提交：37b64f8a。
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 37b64f8a1f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| const originClaim = readManagedOriginCapability( | ||
| resolveDataDir(), | ||
| sid, | ||
| relayDir, | ||
| ); |
There was a problem hiding this comment.
When device credential isolation is enabled but the full file sandbox is disabled, this fallback still cannot authenticate: BOTMUX_SEND_RELAY is unset, while the worker creates neither a Linux relay-outbox capability nor a read-isolation/origin-*.json file for credential-only bwrap, so originClaim is null and /api/report-relay rejects the request with origin_unproven. Fresh evidence after the prior thread is that the new client now reads this capability, but the credential-only worker path was not updated to publish it; therefore the scenario this commit intends to fix still breaks every registry-backed report. Publish a child-readable rotating capability for the credential-only path or provide another session-scoped transport.
AGENTS.md reference: AGENTS.md:L54-L58
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
已补齐 capability 生产端。credential-only worker 现在为每个 session 创建私有轮换目录，bwrap 先用 tmpfs 屏蔽整个 read-isolation 父目录，再只读绑定当前 session 子目录；因此 sibling capability 不可见，同时目录 bind 能观察 atomic rename 后的新 token。worker 在 fresh spawn 与 safe reattach 都会发布当前 session/turn capability，并通过 BOTMUX_ORIGIN_CAPABILITY_DIR 指向该目录；pane marker 升至 v10，使缺少新 mount/env 的旧 pane 强制冷启动。真实 bwrap 验证覆盖了 token v1→v2 轮换可见与 sibling 隐藏，相关 389/389 测试及 pnpm build 通过。修复提交：0f656a86。
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0f656a86ce
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| } | ||
| if (!willReattachPersistent && credentialOnlyBwrap) { | ||
| let credentialOnlyCapabilityDir: string | undefined; | ||
| if (credentialOnlyBwrap) { |
There was a problem hiding this comment.
On macOS when device credential isolation is active but the full file sandbox is disabled, the credential-only Seatbelt profile masks the host HMAC secret, but this new capability publication is guarded exclusively by credentialOnlyBwrap. The existing macOS capability setup is inside if (sandboxRequested), so this combination has neither the secret nor its own published claim; botmux report consequently submits no originCapability and /api/report-relay rejects every registry-backed report with origin_unproven. Add an equivalent current-session capability transport and carve-out to the credential-only Seatbelt path.
AGENTS.md reference: AGENTS.md:L54-L56
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
已补齐 macOS credential-only Seatbelt。worker 现在对 Seatbelt 与 bwrap 共用同一套 per-session capability 发布与 BOTMUX_ORIGIN_CAPABILITY_DIR 注入；Seatbelt profile 先 deny 整个 read-isolation 父目录，只授予父目录 metadata traversal 和当前 session 子目录 read，并在后序规则继续 deny 父目录 write，因此 sibling capability 不可读、当前轮换文件可读且不可写。pane marker 升至 v11，缺少新 profile/env 的 v10 Seatbelt pane 会冷启动。TDD 用例先复现缺失路径，相关 390/390 测试及 pnpm build 通过。修复提交：88169d58。
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 88169d58f8
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| const rawEntry = input.registry[dispatchRoot]; | ||
| const entry = rawEntry && typeof rawEntry === 'object' && !Array.isArray(rawEntry) | ||
| ? rawEntry as Record<string, unknown> | ||
| : undefined; | ||
| const targetLarkAppId = typeof entry?.orchAppId === 'string' ? entry.orchAppId.trim() : ''; | ||
| const targetSessionId = typeof entry?.orchSessionId === 'string' | ||
| ? entry.orchSessionId.trim() | ||
| : ''; |
There was a problem hiding this comment.
When device credential isolation is enabled without the full file sandbox, both credential-only wrappers still permit writes to orchestrate-dispatch.json (bwrap binds / read-write, while the Seatbelt profile only protects credential/profile paths). An isolated CLI can therefore copy any other live orchAppId/orchSessionId tuple from the readable registry into its own capability-bound dispatch-root entry, then call this relay; these lines treat that caller-modified entry as trusted and send an HMAC-authenticated trigger into the victim session. Bind the target to host-owned immutable provenance, authenticate registry entries, or make this registry host-write-only before using it as an authorization source.
AGENTS.md reference: AGENTS.md:L54-L58
Useful? React with 👍 / 👎.
1 participant
改动
botmux report在可读取宿主密钥时继续使用fetchDaemonIpc，为最终/api/trigger请求补齐 HMAC 鉴权。/api/report-relay：隔离 CLI 只向当前 Bot daemon 提交轮换的会话 capability。原因
Daemon 的
/api/trigger在非 core-only 模式要求X-Botmux-Cli-*鉴权头。原实现直接请求 loopback HTTP，因缺少签名头被鉴权中间件以401 missing_headers拒绝。第一次修复改用fetchDaemonIpc后，credential-only bwrap 又会因为刻意屏蔽.dashboard-secret而无法签名；第二次只补读取端仍不完整，因为 worker 尚未发布 capability。最终方案由 worker 发布当前 session/turn 的私有轮换能力，最终 HMAC 签名始终留在可信 daemon 中。影响面
验证
pnpm build：通过。v1→v2后对长驻子进程可见，兄弟 session 目录不可见。platform-http-family.test.ts有 2 例受当前宿主localhostIPv6 解析环境限制；v3-distillation-runner.test.ts的并发超时用例单独重跑 33/33 通过。