feat: add authenticated caller-tool delegation for git agents - #102
Draft
adityathebe wants to merge 4 commits into
Draft
feat: add authenticated caller-tool delegation for git agents#102adityathebe wants to merge 4 commits into
adityathebe wants to merge 4 commits into
Conversation
Issue task-bound caller-tool capabilities from the supervisor and deliver them through the authenticated HTTPS sidecar control channel without placing credentials in Git protocol data. Restrict discovery and execution to the parent-authorized allowlist, recheck task and agent bindings on every call, and revoke or expire capabilities with secret-free audit events. Amp-Thread-ID: https://ampcode.com/threads/T-01a03e3c-39ce-714c-b7fe-60010c4f452f
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: trueThanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Gavel summary
Totals: 0 passed · 0 failed · 0 skipped · - |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Gavel summary
Totals: 4373 passed · 0 failed · 12 skipped · 3m38s |
Chat requests previously had no supported way to select a remote Git agent and delegated caller tools, leaving authenticated delegation reachable only through lower-level runtime configuration. Expose sandbox, agent, and tool selection in chat; resolve that untrusted selection server-side; preserve ordered tool policy through execution and approval continuations; and validate caller-tool input before approval brokerage. Consume clicky-ui 0.3.27 so overlapping Agent and CLI model selections remain coherent. Amp-Thread-ID: https://ampcode.com/threads/T-01a03e3c-39ce-714c-b7fe-60010c4f452f
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
CodeQL traced task-derived values into ordinary filesystem path operations used for transient capability secrets. Task IDs were constrained, but the storage boundary still depended on that validation and could follow a replaced state-directory symlink. Create, read, remove, and clean up those secrets through os.Root with exclusive 0600 files, confining every task-relative name to the sidecar repository. Amp-Thread-ID: https://ampcode.com/threads/T-01a03e3c-39ce-714c-b7fe-60010c4f452f
Review found duplicate capability validation, opaque schema-validation placement, a hand-written proxy that could buffer future streamed responses, and imprecise expired-session re-registration. Keep one final liveness check, document the synthetic input and route-carrier invariants, use a streaming ReverseProxy, retire expired sessions without racing replacement grants, and make the runner's caller-tool endpoint argument explicit. Amp-Thread-ID: https://ampcode.com/threads/T-01a03e3c-39ce-714c-b7fe-60010c4f452f
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Remote Git agents can run prompts, but they cannot safely use tools owned by the Captain supervisor. Passing supervisor credentials or unrestricted tool access through Git would persist secrets and widen the remote agent’s authority.
This PR adds task-scoped caller-tool delegation. An operator can select a remote Git agent and the exact supervisor tools it may request while the supervisor remains responsible for authorization, approval, and execution.
Security model
Behavior changes
/git/is now explicitly routed to Git smart HTTP instead of falling through to the SPA.Authorizationheader are now verified, so stale or invalid local tokens return401.