worker's plan logins: opt-in, read-only, for one job (#83)

OP OpenVibers committed 14 days ago · tag v0.33. · 0 files, +0 −0
* worker: the owner's plan logins, opt-in, read-only, for one job

A coding CLI signs in with a file in the owner's home (~/.claude/.credentials.json, ~/.codex/auth.json,
~/.local/share/opencode/auth.json and the like). A job that runs on the owner's machine wants the plan the owner
signed in for, but a job is code from a task: it may not read the owner's files, and the Node may not send a
credential anywhere.

So worker.plan_logins (off by default) names the files, and the Node copies each one into that one job's private
home, read-only (mode 0400), at the same path it has under the owner's home. The copy is made in the job's own
directory and goes with it; its content is never logged, never uploaded and never part of a result.

The installer moves to the OpenVibe.Codes v0.5.0 job runner, which runs every harness the private portal runs.

* worker: gofmt

* worker: the plan logins build on every platform

The copy into the job's home opens the staged file relative to the job's root, without following a symlink out of
it: syscall.Openat is Linux's, so that part belongs with the Linux sandbox. The portable half (staging the owner's
files, the copy that writes them read-only) stays where every platform can build it.

* worker: the plan-login tests set the home the way each platform reads it

os.UserHomeDir reads HOME on Linux and macOS and USERPROFILE on Windows, so a test that set only HOME left the
Windows runner pointing at its own profile and every login outside it.

* worker: the plan-login test compares the name the way the platform writes it

A path under the home is written with the platform's separator, so the test joins it rather than spelling it out.

* worker: the read-only check holds where the mode is what keeps the job out

Root may write a read-only file, so on a host that runs the tests as root the write is not the check: the mode is.

* 0.33.0: the owner's plan logins, opt-in and read-only, and the OpenVibe.Codes v0.5.0 job runner

The worker copies the owner's coding-CLI sign-in files (worker.plan_logins, off by default) read-only into a job's
private home, so a job may use the plan the owner signed in for without a job ever reading the owner's files and
without the Node ever sending a credential anywhere.
This commit has no diff to show.