Run every command on the build VM over SSH (M1.3) #93

Merged

dongar merged 5 commits from ssh-execution into main 2026-10-02 22:44:22 +00:00

Conversation 2 Commits 5 Files Changed 36

+1492 -316

5 Commits

Author	SHA1	Message	Date
dongarandClaude Opus 5.5	d5cef02e89	Keep credentials out of reprs; count only live ssh-agents in tests ... A failing CI test printed a test key through SSHKey's default repr. Push credentials, AgentConfig's tokens and MatrixConfig's token are now excluded from their reprs, so no failure or log line can print them. In CI's container killed ssh-agents linger as zombies, so the tests count only live ones. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE	2026-10-02 22:41:01 +00:00
dongarandClaude Opus 5.5	e02bac110d	Publish only the work: leave build artifacts out and report them (#80) ... The clone gets the standard build artifacts in its own exclude file, so they never show as changes, even to a model's `git add -A`. The harness's commits leave the same patterns out even when the project tracks them, as the sandbox's main did. What was left out is reported in the publish note and the PR description. Found again in bring-up run 3 (sandbox PR #208). Fixes #80. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE	2026-10-02 22:38:13 +00:00
dongarandClaude Opus 5.5	4f152af170	Flatten harness branch names so a model's branch can't block them ... Live run 3: the executor ran `git checkout -b <task id>` itself, and publishing then failed, because git can't create '<task>/milestone-1' while a branch named '<task>' exists. Milestone and delegation branches are now '<task>-milestone-N' and 'delegation-milestone-N-F'. D4's harness-owned branches (M2.1) remove the cause; this removes the collision on the current loop. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE	2026-10-02 22:29:20 +00:00
dongarandClaude Opus 5.5	c931ac939b	Let pushes go by an HTTPS token or an SSH deploy key ... The push credential is either a push-only account's token, handed to git through a credential helper that names environment variables, never values, or a deploy key in a short-lived ssh-agent. The remote URL follows the credential. Configured as gitea.push_user and push_token, or gitea.push_key. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE	2026-10-02 21:59:56 +00:00
dongarandClaude Opus 5.5	761ebdb857	Run every command on the build VM over SSH (M1.3) ... execution.SSHHost.execute is now the only way the agent runs anything (L13). Commands travel as a script on SSH's stdin, so the secrets handed to a call are never on a command line, and every value handed out is redacted from the output. Timeouts kill the remote process group, and an unreachable host is reported as such, not as a failed command. Workspace and GitRepo run on the build VM. The clone uses the repository's SSH URL, so no credential is stored in it (#89); fetches and pushes get the push key over stdin, in a short-lived ssh-agent, and PRs are still opened from the agent's host with its API token. The bench runs on the build host too. Tests reach "the build VM" through a throwaway local sshd (nisse_dev .testing); CI installs openssh-server. The live push test now pushes with the sandbox's deploy key (NISSE_PUSH_KEY). Fixes #89. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE	2026-10-02 21:39:46 +00:00