feat: forward run container ports for agent OAuth logins - #73
Merged
Conversation
Agents in run containers could not finish browser OAuth logins: the harness listens on a container port (Codex uses 1455) while the browser redirect lands on the user's machine. The server now accepts direct-tcpip channels targeting run:<run-id>, gated by the Steer capability, resolving the container address server-side; arbitrary hosts are refused and reverse forwarding stays disabled. The CLI gains aether forward, the local gateway gains forward.start/status/ stop, and the dashboard offers Forward a port on live runs. Protecting a run now publishes a run.protected event so the dashboard flips Protect/Unprotect live and marks protected runs with a shield on the board and run header. Run ending actions are one per lifecycle stage: Kill while the agent is alive, Close (asking merged or abandoned) while it waits for review, Delete once it has ended.
Contributor
Author
|
Merged with the integration job red. Evidence it is CI-environment flake, not this change:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Agents in run containers could not finish browser OAuth logins: the harness listens on a container port (Codex uses 1455) while the browser redirect lands on the user's machine.
Port forwarding
direct-tcpipchannels targetingrun:<run-id>only. The Steer capability gates the channel, the server resolves the container address itself, and arbitrary hosts stay refused; reverse forwarding remains disabled.aether forward <run-id> <port> [--local <port>]pipes a loopback listener through the channel with half-close propagation.forward.start/forward.status/forward.stop, and the dashboard offers "Forward a port" on live runs (defaults to 1455).Protect state, live
run.protectnow publishes arun.protectedevent; the dashboard flips Protect/Unprotect without a reload and marks protected runs with a shield on the board card and run header. Previously only a timeline note was published and the button label went stale.One ending action per lifecycle stage
Kill while the agent is alive, Close (dialog asks merged or abandoned) while it waits for review, Delete once it has ended. Previously a needs-attention run offered four overlapping ending buttons at once, and Kill was offered on finished runs where it only said "use Delete instead".
Verification
make fmt-check vet lint test test-scripts public-audit,bun run typecheck,bun run test(580 tests) all pass.aether forward <run> 1455and the dashboard Forward dialog both served HTTP 200 from a listener inside a run container; unknown-run and dead-container forwards are refused; Protect/Unprotect flips live with the shield indicator; the Close dialog recorded an abandoned outcome and removed the run from the board.