fix: agent state follows the service identity (#598) - #600
Merged
Merged
Conversation
A root-run setup for a non-root service left every agent-maintained root (persistent Kimaki config, site runtime config, installation profile) root-owned, so each later non-root upgrade sprayed cp/chmod permission errors and silently kept stale plugin sources, skills, and hooks. - lib/agent-state-ownership.sh: enumerate the agent-maintained roots; reconcile() hands them to SERVICE_USER as root (site group preserved); audit() reports unmaintainable roots once as non-root with a single root_repair_required record and the exact one-shot command. - setup.sh and --migrate-non-root reconcile at the end, so a root-run install leaves no root-owned agent state behind. - upgrade.sh reconciles as root, audits as non-root, adds --reconcile-agent-state-ownership (root-only one-shot), and reports in the summary. - Kimaki config sync, OpenCode subagent projection, and the Claude Code hook install skip cleanly into Pending when their root is unmaintainable instead of failing file by file. - Help text: --root is the workspace-mode default; owned mode is non-root. Fixes #598
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
setup.shdefaults to running as root while the agent runs as a dedicated service user. Everything setup wrote for the agent to maintain —/opt/kimaki-config,<site>/.opencode,<site>/.claude,<site>/.wp-coding-agents— stayed root-owned. Every later non-root./upgrade.shthen degraded into per-filecp:/chmod:permission errors and silently kept stale Kimaki plugin sources, skills, subagent projection and hooks, while printing asudocommand as the fix. #597 patched the first symptom (unreadable profile); this fixes the cause.Change
New
lib/agent-state-ownership.shagent_state_ownership_roots— the agent-maintained set only (persistent Kimaki config dir,.wp-coding-agents,.opencode,.claude,.codexunder the site). Symlinked roots skipped. Privileged host state (units, sudoers, journald) deliberately excluded — that stays behind the systems-capabilities handoff.agent_state_ownership_reconcile(root) —chown -Reach root not fully owned bySERVICE_USER; roots under the site keep the site group so www-data retains access. Idempotent; no-op when already owned, non-root, local mode, or root service.agent_state_ownership_audit(non-root) — read-only; lists each unmaintainable root once with its owner, emits one{"status":"root_repair_required","component":"agent_state_ownership","paths":[…],"repair_command":…}record. Maintainability = every entry owned by the current uid (group-writable is not enough: only the owner canchmod +xthe hook).agent_state_ownership_can_maintain <path>— lets phases skip cleanly.Wiring
setup.sh: reconcile after all phases → a root-run setup for a non-root service leaves zero root-owned agent state.--migrate-non-root: reconcile after the site reclaim.upgrade.sh: reconcile as root / audit as non-root right after identity resolution; new--reconcile-agent-state-ownership(root-only one-shot, exits after); summary shows the repair command.bridge_sync_config), OpenCode subagent projection, and the Claude Code hook install check maintainability and skip intoPENDING_ITEMSwith one warning instead of failing per file.--rootis the workspace-mode default; owned mode is non-root (matches No model for agent server capability: every install runs an unrestricted root shell, including managed #327 behaviour that the help text contradicted).Verified
tests/agent-state-ownership.sh(new, in CI matrix): root set, symlink skip, clean-tree audit, consolidated single record + owner + repair command, descendant skip, non-root reconcile no-op, wiring assertions; a root-only branch covers the chown/group/idempotency path.installation-profile,opencode-subagents-optional,service-migration,service-identity-defaults,ci-coveragestill pass.opencode): exit 0, zerocp:/chmod:errors, one[agent-state]block naming the four roots and the one-shot command, three phases skipped into Pending.Fixes #598. Follows #597.
Authored by Extra Chill Bot (AI agent); not yet human-reviewed.