Skip to content

v0.24.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 27 Oct 08:46
· 22 commits to master since this release
v0.24.0
2841b7b

Overview

Use the CLI on a server or VM (#87)

stashbase ssh puts the CLI on a machine you reach over SSH and connects you to it, so agents can run there instead of on your laptop. You can check on them from anywhere, including an SSH app on your phone.

stashbase ssh install mybox    # a host from ~/.ssh/config, or user@host
stashbase ssh setup mybox      # the machine's own `stashbase setup`, then checks the key and Docker
stashbase ssh open mybox       # connect and attach to the machine's `stashbase` tmux session
stashbase ssh uninstall mybox  # remove the CLI, its config and stored keys
  • Your own ssh: your SSH config, keys, agent and jump hosts apply. Nothing about the machine is stored on your laptop.
  • ssh install checks the machine's platform and any existing install, asks before installing or updating (--yes skips it), and updates the copy that ssh mybox actually runs. A password, security key or 2FA prompt comes once per command.
  • ssh setup runs the machine's interactive setup, so you enter a key meant for that machine. The key on your laptop is never copied. Afterwards it checks that the key works and whether Docker is ready, and says how to fix anything missing.
  • ssh open attaches to a tmux session named stashbase, so agents keep running when you detach or the connection drops. --with screen|zellij|none picks another multiplexer or a plain shell. --port 3000 makes a port on the machine, such as a dev server, reachable at localhost:3000 while you're connected.
  • ssh uninstall lists what it will delete and asks first. Revoke the machine's key in the dashboard too.
  • The CLI on the machine is the normal CLI, so everything else works there as usual. Agents aren't installed by these commands: install your agent on the machine, or use the Docker sandbox, whose image already includes Claude Code and Codex.
  • Use one machine per developer. Users of a shared machine aren't kept apart: members of the docker group are effectively root.

API keys on machines without a keyring (#84)

On a server you reach over SSH (no Secret Service), in a container, or on a Mac over SSH with a locked Keychain, the CLI had nowhere safe to keep the API key. Every command warned, and named profiles couldn't be created.

  • Keys fall back to credentials.toml next to config.toml, readable only by you. The CLI says so once, when it saves the key.
  • Agent runs with the native sandbox can't read that file, the same way STASHBASE_API_KEY is kept out of their environment. The Docker sandbox never mounts the config directory.
  • No more warning on every command (#86). stashbase doctor now shows where the key is stored (macOS Keychain, Secret Service, or the credentials file).
  • On such a machine, a key still in config.toml moves into the credentials file with the next command.

Changes

  • The Docker sandbox works again on Linux (#85). On a Linux machine with Docker Engine, agent run with the Docker backend failed before the agent started, with No file descriptors available (os error 24) or proxy unreachable (curl exit 28). The sandbox's network check made the Agent Proxy forward a request to itself in a loop. Docker Desktop on macOS and Windows wasn't affected.
  • agent docker doctor says how to fix a failed check: install Docker, start the daemon (sudo systemctl enable --now docker), or add your user to the docker group. With --json it's in fix_hint.
  • agent run suggests tmux when you start it over SSH outside a terminal multiplexer, since a dropped connection would end the agent.
  • Fixed: the command that moved a key out of config.toml lost it for the rest of that command and failed with a missing API key (#84).
  • Telemetry now also records ssh install (not setup, open or uninstall). See docs/telemetry.md.

Compatibility

  • ssh install needs an x86_64 Linux machine or an Apple Silicon Mac with bash and curl or wget. ARM Linux machines are refused with a clear message until there's an ARM Linux build.
  • From Windows, the ssh commands connect once per step, so a password prompt can come more than once.
  • doctor output changed: the Secure store check is now Key storage, and a key in config.toml is no longer called "legacy".
Assets 6
Loading