Repository navigation
2.4.1: signed-out stores, killed commands in the audit, enclave prompt cancel - #225
Merged
Merged
Conversation
…t cancel Signed-out gcloud and az: - A sealed store records whether it holds a login, beside every write (<root>/stores/<name>.json, the same kind of file the AWS sign-in already had; one loginState type now serves both). Prompt-free. - `jit wrap list` shows "signed out" instead of "login sealed", and the JSON's store rows carry store_signed_in (absent until a 2.4.1 write). - gcloud accounts are read from legacy_credentials/<account>/: a revoke deletes the folder but SQLite keeps the revoked token's bytes in credentials.db, so a byte search would say signed in (checked against gcloud 587.0.0). az's are the MSAL accounts and SP entries; `az logout` keeps the file, empty of accounts. - A run that signs out now says "gcloud is signed out" instead of "sealed gcloud's login", for a store that is not empty. - Real-CLI e2e: gcloud `auth revoke --all` and az's last `logout` both read as signed out. Killed commands in the audit log: - A command killed while its own approval prompt is up (Ctrl-C, a closed terminal, a timeout's SIGTERM) used to leave no line: commands are recorded when they return. awaitApproval catches SIGINT/TERM/HUP only around that wait, writes "stopped by SIGTERM while waiting for approval", then re-raises the signal. Not process-wide: store runs, aws-sso and the service keep their own signal handling. - Every in-process approval prompt goes through it (fresh auth, vault restore, consent off, uninstall). Checked on a real Mac. Secure Enclave prompt cancel: - se_open registers its LAContext and se_cancel_open invalidates it, as keychainwrap's cancel does, so the service closes an enclave unlock dialog whose caller exited too. Unit-tested; the hardware test (JIT_SE_INTERACTIVE=1 scripts/se-test.sh -test.run TestHardwareCancelClosesTheDialog) needs the signing setup this test Mac lacks. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013G3wGWfP4RdccpQTpTqed4
`login_command` ("gcloud auth login", "az login") on every store row,
a family member carrying its namesake's, so the app can offer a signed-out
store a Log In button that runs it through the shim (sealed straight into
the vault) without keeping its own tool-to-command list. One field on
ToolStore, the table everything else about a store reads from.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013G3wGWfP4RdccpQTpTqed4
3 of 5 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The three small gaps left after #224, for 2.4.1.
Signed-out gcloud and az. After
gcloud auth revokeoraz logout,jit wrap listsaid "login sealed" for a store with nothing in it. Each store write now records whether it holds a login, the same way the AWS sign-in already did, so the listing can say "signed out" with no prompt. The JSON's store rows carrystore_signed_inandlogin_command("gcloud auth login", "az login"), so the app can offer a Log In button that runs through the shim.legacy_credentials/<account>/folders. A revoke deletes the folder, but SQLite leaves the revoked token's bytes incredentials.db(checked against gcloud 587.0.0).Killed commands in the audit log. A command killed while its approval prompt was up left no line, because commands are recorded when they return. Every in-process approval wait now catches SIGINT, SIGTERM and SIGHUP, writes "stopped by … while waiting for approval", and then lets the signal end the process. This applies only around the wait: store runs,
aws-ssoand the service keep their own signal handling.Secure Enclave prompt cancel. The service can now close an enclave unlock dialog whose caller exited, the way #224 did for the keychain.
Testing
go test -race ./..., staticcheck, gosec, govulncheckJIT_GCLOUD_E2E=1):auth revoke --allreads as signed outJIT_AZURE_E2E=1): the lastaz logoutreads as signed out, and a first logout of one of two accounts doesn'tjit vault restorekilled at its prompt shows injit auditas "stopped by SIGTERM while waiting for approval"JIT_SE_INTERACTIVE=1 scripts/se-test.sh -test.run TestHardwareCancelClosesTheDialog🤖 Generated with Claude Code
https://claude.ai/code/session_013G3wGWfP4RdccpQTpTqed4