dongarandClaude Opus 5.5
761ebdb857
CI / checks (push) Skipped
CI / checks (pull_request) Failing after 55s
execution.SSHHost.execute is now the only way the agent runs anything (L13). Commands travel as a script on SSH's stdin, so the secrets handed to a call are never on a command line, and every value handed out is redacted from the output. Timeouts kill the remote process group, and an unreachable host is reported as such, not as a failed command. Workspace and GitRepo run on the build VM. The clone uses the repository's SSH URL, so no credential is stored in it (#89); fetches and pushes get the push key over stdin, in a short-lived ssh-agent, and PRs are still opened from the agent's host with its API token. The bench runs on the build host too. Tests reach "the build VM" through a throwaway local sshd (nisse_dev .testing); CI installs openssh-server. The live push test now pushes with the sandbox's deploy key (NISSE_PUSH_KEY). Fixes #89. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE
21 lines
1.0 KiB
Bash
21 lines
1.0 KiB
Bash
# Secrets only. Copy to .env (chmod 600); it is gitignored, so never commit
|
|
# real values. Real environment variables win over this file.
|
|
#
|
|
# Everything else lives in the YAML config (see nisse-dev.example.yaml),
|
|
# which refers to these by name, e.g. `token: ${NISSE_LLM_TOKEN}`. The live
|
|
# integration tests use the same names, from tests/integration/nisse-test.yaml.
|
|
|
|
# llm.token: the LiteLLM virtual key (A5)
|
|
NISSE_LLM_TOKEN=replace-me
|
|
# matrix.token: the Matrix access token for the agent's account (A1)
|
|
NISSE_MATRIX_TOKEN=replace-me
|
|
# gitea.token: the Gitea service account's scoped token (B2)
|
|
NISSE_GITEA_TOKEN=replace-me
|
|
# The sandbox repository's deploy key (write access), for the live push test:
|
|
# the private key itself, or here, since a .env line can't hold one, its path.
|
|
NISSE_PUSH_KEY=/root/nisse-e2e/ssh/push_sandbox
|
|
|
|
# Where the config file is, if not ./nisse-dev.yaml. Where this file is, if
|
|
# not ./.env, is NISSE_ENV, which has to be set in the real environment.
|
|
# NISSE_CONFIG=~/nisse-demo-workspace/nisse-dev.yaml
|