docker: give each agent its own Gitea hands, and close the cross-approval hole
Phase 5 of docs/agents/GITEA-SETUP.md, plus a correction to Phase 2 that the runbook could not have known it needed. gitea-mcp v1.7.0 goes into both images, pinned by the sha256 the release publishes and smoke-tested with `--version` at build time, so a bad pin fails the build instead of the agent. Each entrypoint registers it at user scope for that container's own identity, remove-then-add so a restart is idempotent. The token is passed BY PATH. `-e GITEA_ACCESS_TOKEN=$(cat …)` would write it in cleartext into ~/.claude.json, which every session in the container reads; GITEA_ACCESS_TOKEN_FILE is new in the pinned version and leaves the secret in its read-only mount. Verified against the binary's own --help, not assumed. The tool filter stops being an experiment. The names are in the release README: each agent gets issues, notifications, labels, milestones and pull requests, and NOT `pull_request_review_write`. That one matters because separate identities open a hole the runbook did not name: Gitea refuses to let an author approve their own pull request, and does nothing about sylph-decoder approving sylph-port's. Two agents could satisfy `required_approvals = 1` between themselves and then merge, since branch protection blocks pushes to main and never blocked merges. Withholding the tool is defence in depth; the controls are in branch protection, and both docs now say so: approvals whitelisted to the human so an agent's approval does not count, merges whitelisted to the human so an approved PR is still merged by a person. Phase 2's check gains the step that actually tests it -- approve the throwaway PR yourself, then confirm the agent STILL has no merge button. Without that step, the check passes on an instance where the agents can merge each other's work. Also settles two entries on the runbook's own "not verified" list: the tool filter names, and the Gitea version (1.25.5, whose API schema carries enable_merge_whitelist and enable_approvals_whitelist under those names). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01McNbzUeq1KRBWs4G6X2YVj
This commit is contained in:
@@ -208,6 +208,54 @@ python3 /usr/local/bin/seed-claude-config.py "$HOME/.claude.json" "$CLAUDE_VER"
|
||||
"$PWD" "${PROJECT_DIR:-/work}" "$HOME" || true
|
||||
chmod 600 "$HOME/.claude.json" 2>/dev/null || true
|
||||
|
||||
# ── The Gitea MCP server ─────────────────────────────────────────────────────
|
||||
# Registered at USER scope rather than from a committed `.mcp.json`: the token
|
||||
# differs per agent and none of it belongs in git.
|
||||
#
|
||||
# 🔴 THE TOKEN IS PASSED AS A PATH, NOT A VALUE. `-e GITEA_ACCESS_TOKEN=$(cat
|
||||
# …)` would write the secret in cleartext into ~/.claude.json, where it is read
|
||||
# by every session in this container and lands in any copy of that file.
|
||||
# `GITEA_ACCESS_TOKEN_FILE` (gitea-mcp ≥ 1.7.0) leaves the token in its
|
||||
# read-only mount and lets the server read it itself.
|
||||
#
|
||||
# Re-registered on every start, remove-then-add: `claude mcp add` refuses a name
|
||||
# that already exists, and ~/.claude.json is re-seeded above — neither ordering
|
||||
# survives alone.
|
||||
GITEA_TOKEN_FILE="${GITEA_TOKEN_FILE:-$HOME/.sylph-gitea-token}"
|
||||
GITEA_HOST_URL="${SYLPH_GITEA_HOST:-https://git.mc02.dev}"
|
||||
# Which tools this agent gets. Deliberately not all of them:
|
||||
#
|
||||
# * `pull_request_review_write` IS ABSENT, and that is the load-bearing one.
|
||||
# Gitea will not let an author approve its own pull request — but the moment
|
||||
# the two agents are separate people, nothing stops them approving each
|
||||
# OTHER's and satisfying `required_approvals` between themselves with no
|
||||
# human involved. Separate identities open that hole; withholding the tool
|
||||
# closes it here, and the approvals whitelist on `main` closes it there.
|
||||
# * the file / branch / repo WRITE tools are absent: a change reaches `main`
|
||||
# as a reviewable commit through git, or it does not reach it.
|
||||
#
|
||||
# `pull_request_write` bundles `merge` into one tool and cannot be split, so
|
||||
# merging stays blocked where the agent cannot reach it — the merge whitelist in
|
||||
# branch protection. This list is defence in depth BEHIND that, never instead.
|
||||
GITEA_MCP_TOOLS="${SYLPH_GITEA_TOOLS:-get_me,notification_read,notification_write,list_issues,issue_read,issue_write,attachment_read,search_issues,label_read,milestone_read,list_pull_requests,pull_request_read,pull_request_write}"
|
||||
if [ ! -s "$GITEA_TOKEN_FILE" ]; then
|
||||
echo "[entrypoint] no Gitea token at $GITEA_TOKEN_FILE — MCP not registered."
|
||||
echo "[entrypoint] This agent cannot read its notifications or open a pull"
|
||||
echo "[entrypoint] request, which is most of what its brief asks of it."
|
||||
elif ! command -v gitea-mcp >/dev/null 2>&1; then
|
||||
echo "[entrypoint] gitea-mcp is not in this image — rebuild it." >&2
|
||||
else
|
||||
claude mcp remove gitea -s user >/dev/null 2>&1 || true
|
||||
if claude mcp add -s user gitea \
|
||||
-e "GITEA_ACCESS_TOKEN_FILE=$GITEA_TOKEN_FILE" \
|
||||
-- gitea-mcp -t stdio -H "$GITEA_HOST_URL" -O "$GITEA_MCP_TOOLS" >/dev/null 2>&1; then
|
||||
echo "[entrypoint] gitea MCP registered against $GITEA_HOST_URL"
|
||||
else
|
||||
echo "[entrypoint] gitea MCP registration FAILED — the agent has no issues," >&2
|
||||
echo "[entrypoint] no pull requests and no notifications." >&2
|
||||
fi
|
||||
fi
|
||||
|
||||
# ── Claude Code ──────────────────────────────────────────────────────────────
|
||||
if [ "${SYLPH_AUTONOMOUS:-0}" = "1" ]; then
|
||||
# Drop the image's default CMD first, or `claude` is handed the literal string
|
||||
|
||||
Reference in New Issue
Block a user