datatug / datatug-cli / 41895212773

100%

Build Type

push

github

Committed by web-flow

Commit Message

feat(agent): agent sessions keyed by harness session (Perimeter D29) (#576)

Perimeter D29 agent sessions, CLI side.

- `datatug agent session start --harness <name> --harness-session <id> --agent-id ag-…`: the server mints a session; the credential is stored in the OS keyring (go-keyring, keyed by a digest of the harness session ID, with the agent, scope and API base URL); only the session ID is printed.
- Every agent call (`db get`, `db preview`, `access request --agent`) takes `--harness-session` or `DATATUG_HARNESS_SESSION`, sends `X-DataTug-Agent-Session`, refreshes near expiry, and never sends the credential to another base URL. A harness ID with no entry sends no session (standing access only).
- `agent session end` (the plugin's session-end hook) and `agent session status`; stale entries are pruned.
- `access request --agent --lifetime session|deadline`; without a session the request is "Until a deadline", with a note.
- The honest limit is stated in the help: binding scopes honest harness use, not a boundary against a shell agent of the same OS user.

Server: [datatug/backend](https://github.com/datatug/backend) branch perimeter-agent-sessions. Review: two adversarial rounds, final APPROVE (Reviewed-Head: c4a1d0716).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Source commits:

- 22c921ab936f feat(agent): agent sessions bind This-session approvals to a harness session
  Perimeter D29 (agent sessions), CLI half (test plan CL-7, CL-8, CL-10, CL-11).
  - `datatug agent session start --harness --harness-session --agent-id
  --space --project`: starts (or rejoins) the agent session, keeps
  {agentSessionId, credential, expiry, agent, space, project, base URL,
  auth issuer/realm} in the OS keyring (go-keyring, service datatug-cli,
  account agent-session:<sha256 of the harness session ID>). Prints the
  agent session ID, never the credential.
  - `datatug agent session end [--harness-session] [--r... (continued)

Coverage Stats

299 of 299 new or added lines in 5 files covered. (100.0%)

1 existing line in 1 file now uncovered.

94736 of 94738 relevant lines covered (100.0%)

1.01 hits per line