clawdie/colibri
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Activity Actions

feat(clawdie): write scoped operator escalation rules via --operator-user #475

Merged
clawdie merged 1 commit from feat/clawdie-scoped-priv-rules into main 2026-08-02 19:30:13 +02:00
Conversation 0 Commits 1 Files changed 10 +339 -84
clawdie commented 2026-08-02 19:08:24 +02:00
Owner
Copy link

The clawdie installer now grants the operator account command-limited
passwordless escalation for 'colibri upgrade' (issue #300 gap C):

  • ServiceSpec gains an operator field; OS service name is platform-derived
    (colibri_daemon on FreeBSD, colibri-daemon on Linux), matching service_cmd.
  • 'clawdie plan/apply --operator-user USER': FreeBSD appends an idempotent
    'permit nopass USER cmd service|install' fragment to doas.conf; Linux writes
    a 0440 sudoers drop-in /etc/sudoers.d/colibri (systemctl */install * rules).
  • Upgrade pre-flight and the doctor escalation check now probe the scoped
    service-status command (doas -n service colibri_daemon status /
    sudo -n systemctl status colibri-daemon) instead of 'esc -n true', which
    under-reported correctly-scoped hosts; stop/install/start add -n.
  • Docs: doctor.md, clawdie README, handoff doc, AGENTS.md divergence
    checklist updated.

Gates: okf 262/0, wiki-lint 597/0, dates 0, prettier 0. cargo fmt/clippy/tests
run on CI/FreeBSD (no local toolchain).

The clawdie installer now grants the operator account command-limited passwordless escalation for 'colibri upgrade' (issue #300 gap C): - ServiceSpec gains an operator field; OS service name is platform-derived (colibri_daemon on FreeBSD, colibri-daemon on Linux), matching service_cmd. - 'clawdie plan/apply --operator-user USER': FreeBSD appends an idempotent 'permit nopass USER cmd service|install' fragment to doas.conf; Linux writes a 0440 sudoers drop-in /etc/sudoers.d/colibri (systemctl */install * rules). - Upgrade pre-flight and the doctor escalation check now probe the scoped service-status command (doas -n service colibri_daemon status / sudo -n systemctl status colibri-daemon) instead of 'esc -n true', which under-reported correctly-scoped hosts; stop/install/start add -n. - Docs: doctor.md, clawdie README, handoff doc, AGENTS.md divergence checklist updated. Gates: okf 262/0, wiki-lint 597/0, dates 0, prettier 0. cargo fmt/clippy/tests run on CI/FreeBSD (no local toolchain).
feat(clawdie): write scoped operator escalation rules via --operator-user
Some checks failed
CI / python-tests (pull_request) Successful in 4s
Details
CI / rust (pull_request) Failing after 6s
Details
ci-gate / gate (pull_request) Failing after 5s
Details
format-check / prettier (pull_request) Failing after 3s
Details
CI / markdown (pull_request) Failing after 6s
Details
CI / port (pull_request) Failing after 2s
Details
CI / agent-jail-pkgs (pull_request) Failing after 2s
Details
leak-guard / guard (pull_request) Successful in 12s
Details
a24c43fdd0 
The clawdie installer now grants the operator account command-limited
passwordless escalation for 'colibri upgrade' (issue #300 gap C):

- ServiceSpec gains an operator field; OS service name is platform-derived
  (colibri_daemon on FreeBSD, colibri-daemon on Linux), matching service_cmd.
- 'clawdie plan/apply --operator-user USER': FreeBSD appends an idempotent
  'permit nopass USER cmd service|install' fragment to doas.conf; Linux writes
  a 0440 sudoers drop-in /etc/sudoers.d/colibri (systemctl */install * rules).
- Upgrade pre-flight and the doctor escalation check now probe the scoped
  service-status command (doas -n service colibri_daemon status /
  sudo -n systemctl status colibri-daemon) instead of 'esc -n true', which
  under-reported correctly-scoped hosts; stop/install/start add -n.
- Docs: doctor.md, clawdie README, handoff doc, AGENTS.md divergence
  checklist updated.

Gates: okf 262/0, wiki-lint 597/0, dates 0, prettier 0. cargo fmt/clippy/tests
run on CI/FreeBSD (no local toolchain).
clawdie deleted branch feat/clawdie-scoped-priv-rules 2026-08-02 19:30:13 +02:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
doctor-fix
colibri doctor --fix dispatch targets and upgrade self-heal

  
first-proof blocker
gates the first proven end-to-end

  
hardening
security/robustness follow-up, not a first-proof gate

No labels
doctor-fix
first-proof blocker
hardening
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
clawdie/colibri!475
No description provided.