Repository navigation
Scoped command tokens: a credential for one command on one device - #188
Merged
Merged
Conversation
A wcs_ token is bound at issue time to one of the owner's devices and one literal command. The relay admits it only to that device with exec-only capabilities and stamps the command on the authenticated agent control channel; the agent accepts only the exact canonical exec request. Agents that do not register scoped_exec are never handed one. Revocation and expiry stop the next request and end running sessions. See docs/adr/0021-scoped-command-token.md. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…cess Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…n them An older relay's namespace-only lookup excludes kind 'delegated' only; a new kind would have resolved as a full account token. A scoped_tokens row now marks the token scoped. Found in the Codex review. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…he en page The docsite build requires code blocks to be copied, not translated. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds the wcs_ scoped command token (ADR 0021): bound to one of the owner's devices and one literal command, enforced by the relay (device, exec-only rights) and the agent (exact canonical request), revocable, expiring, rollback-safe. Migration 016. CLI: wanctl scoped-token create|list|revoke. Ships with the next regular release; the docs say it is not available until then. ADR stays proposed until it ships.
Tested: full suite and -race with Postgres, real-binary relay+agent+CLI end-to-end, old-binary rollback check, Codex read-only review (1 High fixed, 2 Medium assessed).
🤖 Generated with Claude Code