Add approved transfers and cross-session Files - #17
Merged
Conversation
## Why External agents can operate visible terminal streams but cannot copy a file directly between attached SSH or Local Shell backends. The terminal-stream rescue path exposes payload bytes and has no dedicated per-operation file approval. ## What changed - Add typed backend copies with two terminal-scoped tokens and fresh browser approval. - Stream one regular file between SSH and POSIX Local Shell endpoints with fail-default conflict handling. - Preserve sources and the terminal-stream rescue fallback while failing closed on endpoint or snapshot changes. - Add CLI and MCP helpers plus a dedicated file-transfer skill without silently downgrading transports. ## Testing Backend, boundary, REPL, and browser smoke coverage includes approval, authorization, conflicts, endpoint mutation, source mutation, and ambiguous SSH publish outcomes.
## Why Approved file copies keep the browser decision handler occupied while a transfer runs, so large uploads delay visible status and duplicate clicks can report a false failure. ## What changed - Run approved copies as bounded background work and expose throttled byte progress. - Show file-copy approval across terminal tabs and preserve monotonic action outcomes. - Keep per-copy browser approval mandatory, including Full mode. - Preserve typed query and fail-closed rescue fallback behavior. ## Testing - Backend lifecycle, non-blocking approval, duplicate decisions, progress, worker bounds, SFTP timeouts, and cleanup behavior. - Browser cross-tab approval, stale progress rejection, decision latching, and ordinary command scope. - CLI, MCP boundary, rescue helper, and static-site compatibility.
## Why External Agent bootstrap and token handoff files use the launch directory, which can place transient writes in the checkout. Local Shell processes expose only a generic terminal capability even though the xterm.js frontend supports 24-bit color. ## What changed - Resolve agentinfo and handoff files under an instance-scoped per-user runtime root, while preserving URL-first discovery and explicit overrides. - Remove owned runtime artifacts on graceful shutdown and retain token invalidation as the crash fallback. - Update the published and installable skills to consume runtime-resolved handoff paths. - Keep TERM=xterm-256color while declaring Local Shell truecolor and StandTerm identity; leave SSH PTY negotiation unchanged. ## Testing Covers platform path resolution, restrictive runtime files, cleanup ownership, External Agent boundaries and helpers, browser approval flows, skill validation, and Local Shell environment capabilities.
## Why The browser compares a WSL wall-clock deadline with the Windows clock, so cross-OS clock skew rejects fresh signing requests. The backend also discards the browser's specific rejection detail. ## What changed - Advertise a bounded relative timeout and validate it with browser monotonic time. - Enforce the authoritative backend deadline with monotonic time while retaining the wall-clock expiry for diagnostics. - Surface sanitized, length-limited browser rejection details while preserving SID, profile, key, and challenge binding with no password fallback. ## Testing Covered browser wall-clock skew, backend wall-clock jumps, fail-closed request handling, browser integration, static-site validation, and external-agent boundaries.
## Why The file manager is limited to direct SSH tabs and selecting a file can look like a completed download. Human operators cannot browse Local Shell files or copy a file directly between live terminal endpoints. ## What changed - Expose Files on SSH and supported POSIX Local Shell tabs while preserving the legacy SFTP event and route compatibility. - Add an explicit Copy to workflow that shares the bounded backend stream and atomic publish path while retaining fresh approval for agent-initiated copies. - Reject logical self-copies, correlate duplicate requests, and preserve terminal transaction outcomes across late events and startup failures. - Highlight selection without downloading; retain explicit Download, conflict handling, and unavailable-platform fallbacks. ## Testing - Backend coverage includes Local Shell file actions, human cross-tab copies, conflicts, duplicate requests, state transitions, startup failure, and same-file rejection. - Browser coverage includes Files availability, selection semantics, explicit downloads, destination browsing, typed copy requests, and copy-id event binding.
askac
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release impact
Minor release:
v2.9.0Why
External agents can operate attached terminal streams but have no bounded backend path for copying a file between SSH and Local Shell endpoints. Human operators are limited to an SSH-only SFTP window and cannot copy directly between live tabs; selecting a file can also look like a completed download before the explicit Download action. A running browser copy additionally needs one clear cancellation control and an explicit commit boundary.
What changed
file_copyproposals with two terminal-scoped capabilities, canonical plans, explicit per-copy browser approval, regular-file and conflict checks, and fail-closed endpoint or source mutation handling.committingfallback once publishing starts.agent_scp.py, CLI/MCP integration, and a dedicated file-transfer skill; preserve legacy SFTP routes/events and show Files unavailable when a Local Shell platform lacks anchored POSIX operations.Testing