astrid 0.10.1

Command-line interface for Astrid secure agent runtime
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92

//! MCP session guard: keep one daemon uplink alive for the MCP process lifetime.
//!
//! `astrid mcp serve` is itself the Codex/Claude session handle. The daemon may
//! still be ephemeral: once this process exits, its guard uplink drops and the
//! normal idle timer can shut the daemon down. While this process is alive,
//! though, the daemon should see an authenticated client and should not age out.

use std::time::Duration;

use anyhow::{Context, Result};
use tracing::{debug, warn};
use uuid::Uuid;

use crate::commands::daemon;

const INITIAL_RETRY_BACKOFF: Duration = Duration::from_secs(2);
const MAX_RETRY_BACKOFF: Duration = Duration::from_secs(30);

/// Run until the MCP process exits and Tokio drops this task.
pub(super) async fn run(principal: astrid_core::PrincipalId) {
    let mut retry_backoff = INITIAL_RETRY_BACKOFF;
    loop {
        match hold_guard_uplink(&principal).await {
            Ok(never) => match never {},
            Err(e) => {
                warn!(error = %e, %principal, "MCP session guard: daemon connection unavailable");
                tokio::time::sleep(retry_backoff).await;
                retry_backoff = retry_backoff.saturating_mul(2).min(MAX_RETRY_BACKOFF);
            },
        }
    }
}

async fn hold_guard_uplink(
    principal: &astrid_core::PrincipalId,
) -> Result<std::convert::Infallible> {
    daemon::ensure_daemon_quiet("mcp-session-guard").await?;

    let session = astrid_core::SessionId::from_uuid(Uuid::new_v4());
    let c = crate::socket_client::connect_for_workspace(session, principal.clone(), None)
        .await
        .context("failed to connect guard uplink to daemon")?;

    validate_guard_auth(principal, c.is_authenticated())?;

    debug!(%principal, "MCP session guard: daemon uplink established");
    let mut client = c;
    loop {
        match client.read_raw_frame().await {
            Ok(Some(_)) => {},
            Ok(None) => anyhow::bail!("daemon closed guard uplink"),
            Err(e) => return Err(e).context("guard uplink read failed"),
        }
    }
}

fn validate_guard_auth(principal: &astrid_core::PrincipalId, authenticated: bool) -> Result<()> {
    if authenticated || *principal == astrid_core::PrincipalId::anonymous() {
        return Ok(());
    }

    anyhow::bail!(
        "guard uplink authenticated as anonymous instead of requested principal '{principal}'"
    )
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn guard_auth_accepts_authenticated_principal() {
        let principal = astrid_core::PrincipalId::new("sibyl-code").unwrap();
        assert!(validate_guard_auth(&principal, true).is_ok());
    }

    #[test]
    fn guard_auth_rejects_anonymous_fallback_for_named_principal() {
        let principal = astrid_core::PrincipalId::new("sibyl-code").unwrap();
        let err = validate_guard_auth(&principal, false)
            .expect_err("named principal must not silently fall back to anonymous");
        assert_eq!(
            err.to_string(),
            "guard uplink authenticated as anonymous instead of requested principal 'sibyl-code'"
        );
    }

    #[test]
    fn guard_auth_allows_explicit_anonymous() {
        assert!(validate_guard_auth(&astrid_core::PrincipalId::anonymous(), false).is_ok());
    }
}