agent: add CLI session shim and remote install/repair with Tailscale#139
agent: add CLI session shim and remote install/repair with Tailscale#139AndreyMay wants to merge 2 commits intomodem-dev:mainfrom
Conversation
Greptile SummaryThis PR delivers CLI-backed dev-agent support and remote install/repair workflows, enabling control-agent to spawn ephemeral dev agents using Claude Code or Codex CLIs instead of only the pi runtime. Major changes include CLI session shim providing Unix socket RPC compatibility, remote operations module with checkpointed workflows for Hetzner and existing hosts, optional Tailscale integration, control-agent scripts for CLI backend lifecycle, and comprehensive test coverage with 500+ new test lines. Implementation uses curl with bash pattern for remote bootstrap (hardcoded to trusted sources), SSH with StrictHostKeyChecking accept-new for automated provisioning, and state files stored with restrictive permissions. Confidence Score: 4/5
Important Files Changed
Flowchart%%{init: {'theme': 'neutral'}}%%
flowchart TD
A[baudbot remote install] --> B{Mode?}
B -->|hetzner| C[Provision Hetzner Server]
B -->|host| D[Use Existing Host]
C --> E[Create SSH Key]
D --> E
E --> F[Wait SSH Reachable]
F --> G[Run Bootstrap Script]
G --> H[Run baudbot install]
H --> I[Run Doctor Check]
I --> J{Tailscale?}
J -->|enabled| K[Install Tailscale]
K --> L[Tailscale Up]
L --> M[Wait for Running State]
J -->|skip| N[Mark Complete]
M --> N
N --> O[Save Checkpoint]
P[control-agent] --> Q[Spawn CLI Dev Agent]
Q --> R[Launch tmux Session]
R --> S[Start CLI Session Shim]
S --> T[Create Unix Socket]
P --> U[send_to_session RPC]
U --> T
T --> V[Forward to tmux via send-keys]
V --> W[CLI Agent Processes]
W --> X[Capture tmux Output]
X --> Y[Return via turn_end Event]
Y --> P
Last reviewed commit: 216220d |
|
Hey, can you help me understand what this looks like user side? |
![sentry[bot]](https://avatars.githubusercontent.com/in/12637?s=60&v=4){kind=small}
| local admin_user | ||
| admin_user="$(remote_prompt_default "Admin username for setup" "")" | ||
| if [ -n "$admin_user" ]; then | ||
| if ! remote_run_repair_action "$dry_run" "$ssh_user" "$host" "$ssh_key_path" "[$target] rerun setup" "sudo baudbot setup $admin_user"; then |
There was a problem hiding this comment.
Bug: User input for the admin_user variable is not escaped before being used in a shell command, creating a command injection vulnerability in the 'rerun setup' action.
Severity: CRITICAL
Suggested Fix
The admin_user variable must be escaped before being used in the command string. Use a shell-quoting function, similar to how remote_shell_single_quote is used for the tailscale_auth_key, and wrap the escaped variable in single quotes within the command string to prevent shell interpretation.
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.
Location: bin/remote.sh#L990-L993
Potential issue: The `admin_user` variable, obtained from user input via the
`remote_prompt_default` function, is directly interpolated into a shell command string
without proper escaping or quoting. This command is then executed on a remote host via
`remote_ssh_exec`. An attacker can provide a malicious string containing shell
metacharacters (e.g., `;`, `|`, or `$()`) as the admin username. This allows for
arbitrary command injection, leading to remote code execution on the managed system with
elevated privileges.
Did we get this right? 👍 / 👎 to inform future reviews.
2 participants
What
This PR delivers two major operator/runtime improvements:
send_to_session/list_sessionssemantics.baudbot remotemodule for checkpointed remote install/repair workflows (Hetzner + existing hosts), including optional Tailscale setup for secure instance access.Included changes
CLI dev-agent parity layer
pi/extensions/cli-session-shim.mjspi/skills/control-agent/scripts/pi/skills/dev-agent-cli/Remote operations module
baudbot remotecommand wired throughbin/baudbotbin/remote.shbin/lib/remote-common.shbin/lib/remote-ssh.shbin/lib/remote-hetzner.sh~/.baudbot/remote/targets/<target>.jsontailscale_connected--tailscale,--no-tailscale,--tailscale-auth-keyTest coverage and docs
README.md,docs/operations.md,CONFIGURATION.mdChecklist
npm test)npm run lint)bin/security-audit.sh --deep) — if touching security code