pdurlej/platform

Fork 0

feat(agent-access): prune stopped and expired sessions #108

Merged

pdurlej merged 1 commit from codex/issues/95-prune-sessions-rewrite into main

2026-05-06 01:11:30 +02:00

codex commented

2026-05-06 00:53:58 +02:00

Collaborator

Canary status: approve_merge — 6/6 reviewers OK on f269673274c23f3db54ab3ea432c7536b93f9382.

Canary Context Pack

Product story

After #93 gave safe visibility into non-secret ssh-agent sessions, the operator needs controlled cleanup without risking active or unknown access-bearing state. This rewrite keeps the friction high: prune only removes directories when metadata is validated, the agent handle is private, and the recorded PID is already absent.

What changed

Added --prune to scripts/agent-access/codex-openclaw-ssh-agent.
Prunes only validated expired and stopped sessions.
Skips active, unknown, malformed, invalid, unsafe, missing-agent-env, non-private-agent-env, and still-live-PID sessions.
Does not kill a present PID during prune; if PID is present, it emits SKIP_AGENT_ALIVE and keeps the directory.
Requires agent.env to be a regular 0600 file before trusting its socket/PID values.
Documents the prune behavior in the Codex OpenClaw SSH runbook.
Adds tests for eligible pruning, skip behavior, unconfirmed PID, open agent.env, open sessions/, reaped PID fixtures, and private-key non-leakage.

Why it changed

#96 hit its 3-iteration cap with one remaining high finding: prune trusted agent.env without verifying private file mode. This PR is a clean rewrite with that finding fixed and a fresh canary budget.

Files touched

scripts/agent-access/codex-openclaw-ssh-agent
control-plane/platformctl/tests/test_agent_access_ssh_agent.py
docs/agent-access/codex-openclaw-ssh.md

Relevant context

Parent #79: session lifecycle hardening.
Child #95: prune stopped and expired sessions.
PR #93: non-secret --list contract merged.
PR #96: closed as rewrite after 3-iteration cap.
Security-sensitive lane from #82 applies: smallest PR, explicit evidence, canary before merge.

Runtime evidence

PYTHONPATH=control-plane pytest -q control-plane/platformctl/tests/test_agent_access_ssh_agent.py -> 17 passed
PYTHONPATH=control-plane pytest -q control-plane/platformctl/tests -> 175 passed
git diff --check origin/main -> pass
Current diff secret-pattern scan -> pass

Known constraints

--prune depends on persisted, validated metadata from --list. active still means metadata-unexpired, not live-socket verified. Sessions with missing/bad/open agent.env are skipped rather than deleted, because the wrapper cannot safely confirm agent absence. Persistent SKIP_AGENT_ALIVE or SKIP_NO_AGENT_ENV requires manual inspection or a future explicitly-scoped force command. The runbook now includes a compact prune output legend for the emitted SKIP_* prefixes.

Explicit out-of-scope

No live socket probing.
No PID killing during prune.
No force-prune for missing/bad agent env.
No TTL policy changes.
No Infisical, Forgejo PAT, CI, or OpenClaw runtime changes.

Requested decision

Approve merge if canary confirms --prune removes only safe stopped/expired session state and preserves active/unknown/unconfirmed/non-private state.

Merge blockers

Deleting active or unknown sessions.
Deleting a session when recorded PID is still present.
Deleting a session with missing, unreadable, symlinked, malformed, or non-0600 agent.env.
Mutating group/world-open sessions/ permissions instead of failing.
Any private-key material in stdout/stderr/session files.
Requiring the OpenClaw private-key env to prune.

Spec sources read

Issue #79 — parent lifecycle hardening scope.
Issue #95 — child scope and acceptance criteria.
scripts/agent-access/codex-openclaw-ssh-agent — implementation target.
control-plane/platformctl/tests/test_agent_access_ssh_agent.py — wrapper test harness.
docs/agent-access/codex-openclaw-ssh.md — operator runbook update.
PR #93 body/diff — current --list contract this prune slice builds on.
PR #96 canary output — rewrite trigger and high finding addressed here.

Closes #95
Refs #79
Supersedes #96

Canary status: approve_merge — 6/6 reviewers OK on `f269673274c23f3db54ab3ea432c7536b93f9382`. ## Canary Context Pack ### Product story After #93 gave safe visibility into non-secret ssh-agent sessions, the operator needs controlled cleanup without risking active or unknown access-bearing state. This rewrite keeps the friction high: prune only removes directories when metadata is validated, the agent handle is private, and the recorded PID is already absent. ### What changed - Added `--prune` to `scripts/agent-access/codex-openclaw-ssh-agent`. - Prunes only validated `expired` and `stopped` sessions. - Skips `active`, `unknown`, malformed, invalid, unsafe, missing-agent-env, non-private-agent-env, and still-live-PID sessions. - Does not kill a present PID during prune; if PID is present, it emits `SKIP_AGENT_ALIVE` and keeps the directory. - Requires `agent.env` to be a regular `0600` file before trusting its socket/PID values. - Documents the prune behavior in the Codex OpenClaw SSH runbook. - Adds tests for eligible pruning, skip behavior, unconfirmed PID, open `agent.env`, open `sessions/`, reaped PID fixtures, and private-key non-leakage. ### Why it changed #96 hit its 3-iteration cap with one remaining high finding: prune trusted `agent.env` without verifying private file mode. This PR is a clean rewrite with that finding fixed and a fresh canary budget. ### Files touched - `scripts/agent-access/codex-openclaw-ssh-agent` - `control-plane/platformctl/tests/test_agent_access_ssh_agent.py` - `docs/agent-access/codex-openclaw-ssh.md` ### Relevant context - Parent #79: session lifecycle hardening. - Child #95: prune stopped and expired sessions. - PR #93: non-secret `--list` contract merged. - PR #96: closed as `rewrite` after 3-iteration cap. - Security-sensitive lane from #82 applies: smallest PR, explicit evidence, canary before merge. ### Runtime evidence - `PYTHONPATH=control-plane pytest -q control-plane/platformctl/tests/test_agent_access_ssh_agent.py` -> `17 passed` - `PYTHONPATH=control-plane pytest -q control-plane/platformctl/tests` -> `175 passed` - `git diff --check origin/main` -> pass - Current diff secret-pattern scan -> pass ### Known constraints `--prune` depends on persisted, validated metadata from `--list`. `active` still means metadata-unexpired, not live-socket verified. Sessions with missing/bad/open `agent.env` are skipped rather than deleted, because the wrapper cannot safely confirm agent absence. Persistent `SKIP_AGENT_ALIVE` or `SKIP_NO_AGENT_ENV` requires manual inspection or a future explicitly-scoped force command. The runbook now includes a compact prune output legend for the emitted `SKIP_*` prefixes. ### Explicit out-of-scope - No live socket probing. - No PID killing during prune. - No force-prune for missing/bad agent env. - No TTL policy changes. - No Infisical, Forgejo PAT, CI, or OpenClaw runtime changes. ### Requested decision Approve merge if canary confirms `--prune` removes only safe stopped/expired session state and preserves active/unknown/unconfirmed/non-private state. ### Merge blockers - Deleting `active` or `unknown` sessions. - Deleting a session when recorded PID is still present. - Deleting a session with missing, unreadable, symlinked, malformed, or non-0600 `agent.env`. - Mutating group/world-open `sessions/` permissions instead of failing. - Any private-key material in stdout/stderr/session files. - Requiring the OpenClaw private-key env to prune. ## Spec sources read - Issue #79 — parent lifecycle hardening scope. - Issue #95 — child scope and acceptance criteria. - `scripts/agent-access/codex-openclaw-ssh-agent` — implementation target. - `control-plane/platformctl/tests/test_agent_access_ssh_agent.py` — wrapper test harness. - `docs/agent-access/codex-openclaw-ssh.md` — operator runbook update. - PR #93 body/diff — current `--list` contract this prune slice builds on. - PR #96 canary output — rewrite trigger and high finding addressed here. Closes #95 Refs #79 Supersedes #96

codex added 1 commit

2026-05-06 00:53:58 +02:00

feat(agent-access): prune stopped and expired sessions

canary-required / collect-diff (pull_request) Successful in 3s

Details

pyfallow / Pyfallow gate (control-plane) (pull_request) Successful in 14s

Details

python-ci / Python 3.11 (pull_request) Failing after 31s

Details

python-ci / Python 3.12 (pull_request) Successful in 32s

Details

python-ci / Python 3.13 (pull_request) Successful in 32s

Details

canary-required / canary (pull_request) Successful in 12s

Details

71528fc410

codex added the

class/security-sensitive

label

2026-05-06 00:54:08 +02:00

codex force-pushed codex/issues/95-prune-sessions-rewrite from 71528fc410

canary-required / collect-diff (pull_request) Successful in 3s

Details

pyfallow / Pyfallow gate (control-plane) (pull_request) Successful in 14s

Details

python-ci / Python 3.11 (pull_request) Failing after 31s

Details

python-ci / Python 3.12 (pull_request) Successful in 32s

Details

python-ci / Python 3.13 (pull_request) Successful in 32s

Details

canary-required / canary (pull_request) Successful in 12s

Details

to f269673274

canary-required / collect-diff (pull_request) Successful in 3s

Details

pyfallow / Pyfallow gate (control-plane) (pull_request) Successful in 15s

Details

python-ci / Python 3.11 (pull_request) Successful in 31s

Details

python-ci / Python 3.12 (pull_request) Successful in 31s

Details

python-ci / Python 3.13 (pull_request) Successful in 31s

Details

canary-required / canary (pull_request) Successful in 12s

Details

2026-05-06 01:02:57 +02:00

Compare

codex commented

2026-05-06 01:10:13 +02:00

Author

Collaborator

Canary iteration 2: approve_merge on f269673274c23f3db54ab3ea432c7536b93f9382. 6/6 reviewers OK.

Local evidence before rerun: focused test 17 passed, full platformctl/tests 175 passed, git diff --check pass, current diff secret-pattern scan pass.

Accepted weak signals for this slice: prune is intentionally conservative and may leave clutter when PID/state cannot be positively confirmed; SKIP_* outputs are expected safety behavior, not automatic failure.

Canary iteration 2: `approve_merge` on `f269673274c23f3db54ab3ea432c7536b93f9382`. 6/6 reviewers OK. Local evidence before rerun: focused test `17 passed`, full `platformctl/tests` `175 passed`, `git diff --check` pass, current diff secret-pattern scan pass. Accepted weak signals for this slice: prune is intentionally conservative and may leave clutter when PID/state cannot be positively confirmed; `SKIP_*` outputs are expected safety behavior, not automatic failure.