docker: give each agent its own Gitea hands, and close the cross-approval hole
Phase 5 of docs/agents/GITEA-SETUP.md, plus a correction to Phase 2 that the runbook could not have known it needed. gitea-mcp v1.7.0 goes into both images, pinned by the sha256 the release publishes and smoke-tested with `--version` at build time, so a bad pin fails the build instead of the agent. Each entrypoint registers it at user scope for that container's own identity, remove-then-add so a restart is idempotent. The token is passed BY PATH. `-e GITEA_ACCESS_TOKEN=$(cat …)` would write it in cleartext into ~/.claude.json, which every session in the container reads; GITEA_ACCESS_TOKEN_FILE is new in the pinned version and leaves the secret in its read-only mount. Verified against the binary's own --help, not assumed. The tool filter stops being an experiment. The names are in the release README: each agent gets issues, notifications, labels, milestones and pull requests, and NOT `pull_request_review_write`. That one matters because separate identities open a hole the runbook did not name: Gitea refuses to let an author approve their own pull request, and does nothing about sylph-decoder approving sylph-port's. Two agents could satisfy `required_approvals = 1` between themselves and then merge, since branch protection blocks pushes to main and never blocked merges. Withholding the tool is defence in depth; the controls are in branch protection, and both docs now say so: approvals whitelisted to the human so an agent's approval does not count, merges whitelisted to the human so an approved PR is still merged by a person. Phase 2's check gains the step that actually tests it -- approve the throwaway PR yourself, then confirm the agent STILL has no merge button. Without that step, the check passes on an instance where the agents can merge each other's work. Also settles two entries on the runbook's own "not verified" list: the tool filter names, and the Gitea version (1.25.5, whose API schema carries enable_merge_whitelist and enable_approvals_whitelist under those names). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01McNbzUeq1KRBWs4G6X2YVj
This commit is contained in:
@@ -82,6 +82,24 @@ RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
|
||||
&& npm cache clean --force \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
|
||||
# ── gitea-mcp ────────────────────────────────────────────────────────────────
|
||||
# The agent's hands on issues, pull requests and notifications — Gitea's own MCP
|
||||
# server, so there is no second store of truth to drift out of sync with the
|
||||
# first.
|
||||
#
|
||||
# PINNED AND CHECKSUMMED, not "whatever is at that URL today": this binary is
|
||||
# handed a token that can write to the repository. The checksum is the one
|
||||
# published in `gitea-mcp_1.7.0_checksums.txt` for the Linux x86_64 asset.
|
||||
ARG GITEA_MCP_VERSION=1.7.0
|
||||
ARG GITEA_MCP_SHA256=bbc9a7b462facd3c56b1558ee6054e91f2fca27a2878b5599afddcf57d446b8d
|
||||
RUN curl -fsSL -o /tmp/gitea-mcp.tar.gz \
|
||||
"https://gitea.com/gitea/gitea-mcp/releases/download/v${GITEA_MCP_VERSION}/gitea-mcp_Linux_x86_64.tar.gz" \
|
||||
&& echo "${GITEA_MCP_SHA256} /tmp/gitea-mcp.tar.gz" | sha256sum -c - \
|
||||
&& tar -xzf /tmp/gitea-mcp.tar.gz -C /usr/local/bin gitea-mcp \
|
||||
&& chmod +x /usr/local/bin/gitea-mcp \
|
||||
&& rm -f /tmp/gitea-mcp.tar.gz \
|
||||
&& gitea-mcp --version
|
||||
|
||||
# ── The agent user ───────────────────────────────────────────────────────────
|
||||
# NOT root, and not negotiable: Claude Code refuses --dangerously-skip-permissions
|
||||
# when it has root privileges. uid/gid 1000 matches the host account so files
|
||||
|
||||
@@ -208,6 +208,54 @@ python3 /usr/local/bin/seed-claude-config.py "$HOME/.claude.json" "$CLAUDE_VER"
|
||||
"$PWD" "${PROJECT_DIR:-/work}" "$HOME" || true
|
||||
chmod 600 "$HOME/.claude.json" 2>/dev/null || true
|
||||
|
||||
# ── The Gitea MCP server ─────────────────────────────────────────────────────
|
||||
# Registered at USER scope rather than from a committed `.mcp.json`: the token
|
||||
# differs per agent and none of it belongs in git.
|
||||
#
|
||||
# 🔴 THE TOKEN IS PASSED AS A PATH, NOT A VALUE. `-e GITEA_ACCESS_TOKEN=$(cat
|
||||
# …)` would write the secret in cleartext into ~/.claude.json, where it is read
|
||||
# by every session in this container and lands in any copy of that file.
|
||||
# `GITEA_ACCESS_TOKEN_FILE` (gitea-mcp ≥ 1.7.0) leaves the token in its
|
||||
# read-only mount and lets the server read it itself.
|
||||
#
|
||||
# Re-registered on every start, remove-then-add: `claude mcp add` refuses a name
|
||||
# that already exists, and ~/.claude.json is re-seeded above — neither ordering
|
||||
# survives alone.
|
||||
GITEA_TOKEN_FILE="${GITEA_TOKEN_FILE:-$HOME/.sylph-gitea-token}"
|
||||
GITEA_HOST_URL="${SYLPH_GITEA_HOST:-https://git.mc02.dev}"
|
||||
# Which tools this agent gets. Deliberately not all of them:
|
||||
#
|
||||
# * `pull_request_review_write` IS ABSENT, and that is the load-bearing one.
|
||||
# Gitea will not let an author approve its own pull request — but the moment
|
||||
# the two agents are separate people, nothing stops them approving each
|
||||
# OTHER's and satisfying `required_approvals` between themselves with no
|
||||
# human involved. Separate identities open that hole; withholding the tool
|
||||
# closes it here, and the approvals whitelist on `main` closes it there.
|
||||
# * the file / branch / repo WRITE tools are absent: a change reaches `main`
|
||||
# as a reviewable commit through git, or it does not reach it.
|
||||
#
|
||||
# `pull_request_write` bundles `merge` into one tool and cannot be split, so
|
||||
# merging stays blocked where the agent cannot reach it — the merge whitelist in
|
||||
# branch protection. This list is defence in depth BEHIND that, never instead.
|
||||
GITEA_MCP_TOOLS="${SYLPH_GITEA_TOOLS:-get_me,notification_read,notification_write,list_issues,issue_read,issue_write,attachment_read,search_issues,label_read,milestone_read,list_pull_requests,pull_request_read,pull_request_write}"
|
||||
if [ ! -s "$GITEA_TOKEN_FILE" ]; then
|
||||
echo "[entrypoint] no Gitea token at $GITEA_TOKEN_FILE — MCP not registered."
|
||||
echo "[entrypoint] This agent cannot read its notifications or open a pull"
|
||||
echo "[entrypoint] request, which is most of what its brief asks of it."
|
||||
elif ! command -v gitea-mcp >/dev/null 2>&1; then
|
||||
echo "[entrypoint] gitea-mcp is not in this image — rebuild it." >&2
|
||||
else
|
||||
claude mcp remove gitea -s user >/dev/null 2>&1 || true
|
||||
if claude mcp add -s user gitea \
|
||||
-e "GITEA_ACCESS_TOKEN_FILE=$GITEA_TOKEN_FILE" \
|
||||
-- gitea-mcp -t stdio -H "$GITEA_HOST_URL" -O "$GITEA_MCP_TOOLS" >/dev/null 2>&1; then
|
||||
echo "[entrypoint] gitea MCP registered against $GITEA_HOST_URL"
|
||||
else
|
||||
echo "[entrypoint] gitea MCP registration FAILED — the agent has no issues," >&2
|
||||
echo "[entrypoint] no pull requests and no notifications." >&2
|
||||
fi
|
||||
fi
|
||||
|
||||
# ── Claude Code ──────────────────────────────────────────────────────────────
|
||||
if [ "${SYLPH_AUTONOMOUS:-0}" = "1" ]; then
|
||||
# Drop the image's default CMD first, or `claude` is handed the literal string
|
||||
|
||||
@@ -23,6 +23,8 @@
|
||||
# SYLPH_REMOTE_NAME Remote Control session name (default: sylpheed-agent)
|
||||
# SYLPH_GIT_CREDENTIALS file with `https://<user>:<token>@host` for push-work
|
||||
# (default: $HOME/.sylph-git-credentials)
|
||||
# SYLPH_GITEA_TOKEN this agent's own Gitea token file
|
||||
# (default: $HOME/.sylph-gitea-token-decoder)
|
||||
# SYLPH_LOOP_INTERVAL fixed loop cadence, e.g. 30m (default: 45m)
|
||||
# SYLPH_CPUS / SYLPH_MEM_GB override the computed half
|
||||
set -euo pipefail
|
||||
@@ -229,6 +231,29 @@ docker_args() {
|
||||
echo " or point SYLPH_GIT_CREDENTIALS elsewhere." >&2
|
||||
fi
|
||||
|
||||
# ── Gitea ──
|
||||
# This agent's OWN token, for its OWN Gitea account — not the push credential
|
||||
# and not the human's. Three reasons it is separate: `~/.sylph-git-credentials`
|
||||
# is scoped `write:repository` and every issue endpoint REFUSES it; a pull
|
||||
# request the agent authored is one a human can approve, which is the entire
|
||||
# review gate; and revoking one agent then touches neither the other nor you.
|
||||
#
|
||||
# Mounted read-only and passed to the MCP server BY PATH — see the entrypoint
|
||||
# for why the value must not go through the environment.
|
||||
# Inert until the file exists: the container still runs, with no issues.
|
||||
GITEATOK="${SYLPH_GITEA_TOKEN:-$HOME/.sylph-gitea-token-decoder}"
|
||||
if [ -f "$GITEATOK" ]; then
|
||||
_out+=(
|
||||
-v "$GITEATOK:/sylph-home/re/.sylph-gitea-token:ro"
|
||||
-e "GITEA_TOKEN_FILE=/sylph-home/re/.sylph-gitea-token"
|
||||
)
|
||||
else
|
||||
echo "==> NOTE: no Gitea token at $GITEATOK — this agent cannot read its" >&2
|
||||
echo " notifications, open an issue or open a pull request. Generate one" >&2
|
||||
echo " while logged in AS sylph-decoder: Settings -> Applications, scopes" >&2
|
||||
echo " write:repository, write:issue, write:notification, read:user." >&2
|
||||
fi
|
||||
|
||||
[ -n "${ANTHROPIC_API_KEY:-}" ] && _out+=(-e "ANTHROPIC_API_KEY=$ANTHROPIC_API_KEY")
|
||||
[ -n "${SYLPH_VULKAN:-}" ] && _out+=(-e "SYLPH_VULKAN=$SYLPH_VULKAN")
|
||||
[ -n "${SYLPH_REMOTE:-}" ] && _out+=(-e "SYLPH_REMOTE=$SYLPH_REMOTE")
|
||||
|
||||
@@ -62,6 +62,24 @@ RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
|
||||
&& npm cache clean --force \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
|
||||
# ── gitea-mcp ────────────────────────────────────────────────────────────────
|
||||
# The agent's hands on issues, pull requests and notifications — Gitea's own MCP
|
||||
# server, so there is no second store of truth to drift out of sync with the
|
||||
# first.
|
||||
#
|
||||
# PINNED AND CHECKSUMMED, not "whatever is at that URL today": this binary is
|
||||
# handed a token that can write to the repository. The checksum is the one
|
||||
# published in `gitea-mcp_1.7.0_checksums.txt` for the Linux x86_64 asset.
|
||||
ARG GITEA_MCP_VERSION=1.7.0
|
||||
ARG GITEA_MCP_SHA256=bbc9a7b462facd3c56b1558ee6054e91f2fca27a2878b5599afddcf57d446b8d
|
||||
RUN curl -fsSL -o /tmp/gitea-mcp.tar.gz \
|
||||
"https://gitea.com/gitea/gitea-mcp/releases/download/v${GITEA_MCP_VERSION}/gitea-mcp_Linux_x86_64.tar.gz" \
|
||||
&& echo "${GITEA_MCP_SHA256} /tmp/gitea-mcp.tar.gz" | sha256sum -c - \
|
||||
&& tar -xzf /tmp/gitea-mcp.tar.gz -C /usr/local/bin gitea-mcp \
|
||||
&& chmod +x /usr/local/bin/gitea-mcp \
|
||||
&& rm -f /tmp/gitea-mcp.tar.gz \
|
||||
&& gitea-mcp --version
|
||||
|
||||
# ── The agent user ───────────────────────────────────────────────────────────
|
||||
# NOT root: Claude Code refuses --dangerously-skip-permissions with root
|
||||
# privileges. Ubuntu 24.04 ships its own `ubuntu` account at uid 1000, so the
|
||||
|
||||
@@ -87,6 +87,54 @@ python3 /usr/local/bin/seed-claude-config.py "$HOME/.claude.json" "$CLAUDE_VER"
|
||||
"$PWD" "${PROJECT_DIR:-/work}" "$HOME" || true
|
||||
chmod 600 "$HOME/.claude.json" 2>/dev/null || true
|
||||
|
||||
# ── The Gitea MCP server ─────────────────────────────────────────────────────
|
||||
# Registered at USER scope rather than from a committed `.mcp.json`: the token
|
||||
# differs per agent and none of it belongs in git.
|
||||
#
|
||||
# 🔴 THE TOKEN IS PASSED AS A PATH, NOT A VALUE. `-e GITEA_ACCESS_TOKEN=$(cat
|
||||
# …)` would write the secret in cleartext into ~/.claude.json, where it is read
|
||||
# by every session in this container and lands in any copy of that file.
|
||||
# `GITEA_ACCESS_TOKEN_FILE` (gitea-mcp ≥ 1.7.0) leaves the token in its
|
||||
# read-only mount and lets the server read it itself.
|
||||
#
|
||||
# Re-registered on every start, remove-then-add: `claude mcp add` refuses a name
|
||||
# that already exists, and ~/.claude.json is re-seeded above — neither ordering
|
||||
# survives alone.
|
||||
GITEA_TOKEN_FILE="${GITEA_TOKEN_FILE:-$HOME/.sylph-gitea-token}"
|
||||
GITEA_HOST_URL="${SYLPH_GITEA_HOST:-https://git.mc02.dev}"
|
||||
# Which tools this agent gets. Deliberately not all of them:
|
||||
#
|
||||
# * `pull_request_review_write` IS ABSENT, and that is the load-bearing one.
|
||||
# Gitea will not let an author approve its own pull request — but the moment
|
||||
# the two agents are separate people, nothing stops them approving each
|
||||
# OTHER's and satisfying `required_approvals` between themselves with no
|
||||
# human involved. Separate identities open that hole; withholding the tool
|
||||
# closes it here, and the approvals whitelist on `main` closes it there.
|
||||
# * the file / branch / repo WRITE tools are absent: a change reaches `main`
|
||||
# as a reviewable commit through git, or it does not reach it.
|
||||
#
|
||||
# `pull_request_write` bundles `merge` into one tool and cannot be split, so
|
||||
# merging stays blocked where the agent cannot reach it — the merge whitelist in
|
||||
# branch protection. This list is defence in depth BEHIND that, never instead.
|
||||
GITEA_MCP_TOOLS="${SYLPH_GITEA_TOOLS:-get_me,notification_read,notification_write,list_issues,issue_read,issue_write,attachment_read,search_issues,label_read,milestone_read,list_pull_requests,pull_request_read,pull_request_write}"
|
||||
if [ ! -s "$GITEA_TOKEN_FILE" ]; then
|
||||
echo "[entrypoint] no Gitea token at $GITEA_TOKEN_FILE — MCP not registered."
|
||||
echo "[entrypoint] This agent cannot read its notifications or open a pull"
|
||||
echo "[entrypoint] request, which is most of what its brief asks of it."
|
||||
elif ! command -v gitea-mcp >/dev/null 2>&1; then
|
||||
echo "[entrypoint] gitea-mcp is not in this image — rebuild it." >&2
|
||||
else
|
||||
claude mcp remove gitea -s user >/dev/null 2>&1 || true
|
||||
if claude mcp add -s user gitea \
|
||||
-e "GITEA_ACCESS_TOKEN_FILE=$GITEA_TOKEN_FILE" \
|
||||
-- gitea-mcp -t stdio -H "$GITEA_HOST_URL" -O "$GITEA_MCP_TOOLS" >/dev/null 2>&1; then
|
||||
echo "[entrypoint] gitea MCP registered against $GITEA_HOST_URL"
|
||||
else
|
||||
echo "[entrypoint] gitea MCP registration FAILED — the agent has no issues," >&2
|
||||
echo "[entrypoint] no pull requests and no notifications." >&2
|
||||
fi
|
||||
fi
|
||||
|
||||
# ── The repository, cloned into THIS AGENT'S OWN volume ─────────────────────
|
||||
# Not a bind mount of a human's working tree. That arrangement bit this project
|
||||
# three times: an agent's `git config --local` captured a human's commits, a
|
||||
|
||||
@@ -14,6 +14,8 @@
|
||||
# SYLPH_PORT_REPO repo to mount at /work (default: this script's parent)
|
||||
# SYLPH_DISC extracted disc root
|
||||
# SYLPH_GIT_CREDENTIALS file with `https://<user>:<token>@host` for push-work
|
||||
# SYLPH_GITEA_TOKEN this agent's own Gitea token file
|
||||
# (default: $HOME/.sylph-gitea-token-port)
|
||||
# SYLPH_LOOP_INTERVAL fixed loop cadence (default 45m)
|
||||
#
|
||||
# ── Two hard-won constraints ────────────────────────────────────────────────
|
||||
@@ -133,6 +135,29 @@ docker_args() {
|
||||
echo " so its work dies with the container." >&2
|
||||
fi
|
||||
|
||||
# ── Gitea ──
|
||||
# This agent's OWN token, for its OWN Gitea account — not the push credential
|
||||
# and not the human's. Three reasons it is separate: `~/.sylph-git-credentials`
|
||||
# is scoped `write:repository` and every issue endpoint REFUSES it; a pull
|
||||
# request the agent authored is one a human can approve, which is the entire
|
||||
# review gate; and revoking one agent then touches neither the other nor you.
|
||||
#
|
||||
# Mounted read-only and passed to the MCP server BY PATH — see the entrypoint
|
||||
# for why the value must not go through the environment.
|
||||
# Inert until the file exists: the container still runs, with no issues.
|
||||
local giteatok="${SYLPH_GITEA_TOKEN:-$HOME/.sylph-gitea-token-port}"
|
||||
if [ -f "$giteatok" ]; then
|
||||
_out+=(
|
||||
-v "$giteatok:/sylph-home/port/.sylph-gitea-token:ro"
|
||||
-e "GITEA_TOKEN_FILE=/sylph-home/port/.sylph-gitea-token"
|
||||
)
|
||||
else
|
||||
echo "==> NOTE: no Gitea token at $giteatok — this agent cannot read its" >&2
|
||||
echo " notifications, open an issue or open a pull request. Generate one" >&2
|
||||
echo " while logged in AS sylph-port: Settings -> Applications, scopes" >&2
|
||||
echo " write:repository, write:issue, write:notification, read:user." >&2
|
||||
fi
|
||||
|
||||
[ -n "${ANTHROPIC_API_KEY:-}" ] && _out+=(-e "ANTHROPIC_API_KEY=$ANTHROPIC_API_KEY")
|
||||
|
||||
# ── GPU ──
|
||||
|
||||
Reference in New Issue
Block a user