pdurlej/platform

Fork 0

fix(agent-access): tighten stop session id validation #110

Merged

pdurlej merged 2 commits from codex/issues/79-stop-session-id into main

2026-05-07 12:33:55 +02:00

codex commented

2026-05-06 01:15:02 +02:00

Collaborator

Canary status: approve_merge — 6/6 reviewers OK on 06829460c8.

Canary Context Pack

Product story

Agent-access session commands should use one canonical session-id shape. After list/prune hardening, --stop remained more permissive than the IDs generated by the wrapper, which creates unnecessary audit ambiguity.

What changed

Removed the looser STOP_SESSION_ID_PATTERN.
--stop <session-id> now uses the same canonical SESSION_ID_PATTERN as generated/listed/pruned sessions.
Added a regression test that TT-12345678 fails with invalid session id before filesystem lookup.

Why it changed

This closes a small lifecycle-hardening residue from #79 and prior canary weak signals without touching prune/list behavior.

Files touched

scripts/agent-access/codex-openclaw-ssh-agent
control-plane/platformctl/tests/test_agent_access_ssh_agent.py

Relevant context

Parent #79: session lifecycle hardening.
Issue #109: tighten stop session id validation.
#84/#90: startup/signal cleanup merged.
#93: --list merged.
#108: conservative --prune merged.
Security-sensitive lane from #82 applies.

Runtime evidence

PYTHONPATH=control-plane pytest -q control-plane/platformctl/tests/test_agent_access_ssh_agent.py -> 18 passed
PYTHONPATH=control-plane pytest -q control-plane/platformctl/tests -> 177 passed
git diff --check origin/main -> pass
Current diff secret-pattern scan -> pass

Known constraints

This is only validation tightening. It may reject previously accepted malformed stop IDs, but those IDs were never produced by the wrapper's session creation path.

Explicit out-of-scope

No --list/--prune behavior changes.
No live socket probing.
No TTL policy changes.
No Infisical, Forgejo PAT, CI, or OpenClaw runtime changes.

Requested decision

Approve merge if canary confirms the validator tightening is safe and the existing valid stop flow remains covered.

Merge blockers

Breaking stop for canonical wrapper-generated session IDs.
Secret leakage in validation/error paths.
Any accidental change to list/prune semantics.

Spec sources read

Issue #79 — parent lifecycle hardening scope.
Issue #109 — child scope and acceptance criteria.
scripts/agent-access/codex-openclaw-ssh-agent — implementation target.
control-plane/platformctl/tests/test_agent_access_ssh_agent.py — wrapper test harness.
Prior canary outputs for lifecycle slices — weak signal on looser stop validator.

Closes #109
Refs #79

Canary status: approve_merge — 6/6 reviewers OK on 06829460c80bed29d99eba8ba3995c19662f1c82. ## Canary Context Pack ### Product story Agent-access session commands should use one canonical session-id shape. After list/prune hardening, `--stop` remained more permissive than the IDs generated by the wrapper, which creates unnecessary audit ambiguity. ### What changed - Removed the looser `STOP_SESSION_ID_PATTERN`. - `--stop <session-id>` now uses the same canonical `SESSION_ID_PATTERN` as generated/listed/pruned sessions. - Added a regression test that `TT-12345678` fails with `invalid session id` before filesystem lookup. ### Why it changed This closes a small lifecycle-hardening residue from #79 and prior canary weak signals without touching prune/list behavior. ### Files touched - `scripts/agent-access/codex-openclaw-ssh-agent` - `control-plane/platformctl/tests/test_agent_access_ssh_agent.py` ### Relevant context - Parent #79: session lifecycle hardening. - Issue #109: tighten stop session id validation. - #84/#90: startup/signal cleanup merged. - #93: `--list` merged. - #108: conservative `--prune` merged. - Security-sensitive lane from #82 applies. ### Runtime evidence - `PYTHONPATH=control-plane pytest -q control-plane/platformctl/tests/test_agent_access_ssh_agent.py` -> `18 passed` - `PYTHONPATH=control-plane pytest -q control-plane/platformctl/tests` -> `177 passed` - `git diff --check origin/main` -> pass - Current diff secret-pattern scan -> pass ### Known constraints This is only validation tightening. It may reject previously accepted malformed stop IDs, but those IDs were never produced by the wrapper's session creation path. ### Explicit out-of-scope - No `--list`/`--prune` behavior changes. - No live socket probing. - No TTL policy changes. - No Infisical, Forgejo PAT, CI, or OpenClaw runtime changes. ### Requested decision Approve merge if canary confirms the validator tightening is safe and the existing valid stop flow remains covered. ### Merge blockers - Breaking stop for canonical wrapper-generated session IDs. - Secret leakage in validation/error paths. - Any accidental change to list/prune semantics. ## Spec sources read - Issue #79 — parent lifecycle hardening scope. - Issue #109 — child scope and acceptance criteria. - `scripts/agent-access/codex-openclaw-ssh-agent` — implementation target. - `control-plane/platformctl/tests/test_agent_access_ssh_agent.py` — wrapper test harness. - Prior canary outputs for lifecycle slices — weak signal on looser stop validator. Closes #109 Refs #79

codex added 1 commit

2026-05-06 01:15:02 +02:00

fix(agent-access): tighten stop session id validation

canary-required / collect-diff (pull_request) Successful in 3s

Details

pyfallow / Pyfallow gate (control-plane) (pull_request) Successful in 16s

Details

python-ci / Python 3.11 (pull_request) Successful in 32s

Details

python-ci / Python 3.12 (pull_request) Successful in 33s

Details

python-ci / Python 3.13 (pull_request) Successful in 33s

Details

canary-required / canary (pull_request) Successful in 12s

Details

06829460c8

codex added the

class/security-sensitive

label

2026-05-06 01:16:03 +02:00

codex commented

2026-05-06 01:17:34 +02:00

Author

Collaborator

Canary 3+3 result: approve_merge on 06829460c80bed29d99eba8ba3995c19662f1c82.

Evidence:

Review command completed successfully.
6/6 reviewers OK: tech-gpt, tech-claude, tech-glm, product-claude, product-glm, product-gpt.
Focused tests: 18 passed.
Full platformctl tests: 177 passed.

Non-blocking follow-ups noted by reviewers:

Consider making the invalid session id error message more operator-friendly.
Consider symmetric lifecycle tests for list/prune canonical id behavior if those surfaces gain id-targeted inputs later.

Canary 3+3 result: approve_merge on `06829460c80bed29d99eba8ba3995c19662f1c82`. Evidence: - Review command completed successfully. - 6/6 reviewers OK: tech-gpt, tech-claude, tech-glm, product-claude, product-glm, product-gpt. - Focused tests: 18 passed. - Full platformctl tests: 177 passed. Non-blocking follow-ups noted by reviewers: - Consider making the invalid session id error message more operator-friendly. - Consider symmetric lifecycle tests for list/prune canonical id behavior if those surfaces gain id-targeted inputs later.

pdurlej added 1 commit

2026-05-07 12:33:44 +02:00