Module agent 

Passphrase agent: holds a passphrase in one long-lived process so that separate lit commands do not each have to ask for it.

Why this exists

The in-process passphrase cache cannot help the command line, because every lit command is a new process that starts with an empty cache. Reusing a passphrase across commands needs something that outlives them.

What it protects against, and what it does not

The agent listens on loopback and authenticates with a token kept in a file only its owner can read. That draws the boundary at other users on this machine: they can reach the port, but not the token, and every request without it is refused.

It draws no boundary at all against other processes running as you. Such a process can read the token file, so it can ask the agent for the passphrase. This is not a shortcoming that a different transport would fix — a Unix socket or a named pipe restricted to the owner grants exactly the same set of processes. On an ordinary operating system, “another program running as me” is inside the trust boundary.

Against that same-user attacker the agent is therefore no stronger than LIT_PASSPHRASE. It is better in two narrower ways: the secret is not in an environment block, where it is visible in process listings and inherited by every child; and it expires, where an exported variable lasts as long as the shell.

The agent is off unless started. Nothing here listens on a port, writes a token, or holds a secret until someone runs lit agent start.

Structs

Endpoint

How a client finds a running agent: a port to connect to and a token to present. Written to a file only its owner can read — that file is what keeps other users on the machine out, so it is the part that matters.

Store

The passphrases an agent is holding.

Enums

Request

What a client sends. Every variant that reads or changes what the agent holds carries the token: there is no unauthenticated operation on the store, not even Status, because whether an agent holds a passphrase for a given repository is itself worth not answering.

Response

What the agent sends back.

Constants

DEFAULT_IDLE_TIMEOUT_SECS

How long an unused entry survives, when the caller names no preference.

Functions

drop_entry

endpoint_path

get

Ask the agent for a passphrase. None covers every ordinary reason there is no answer — no agent, nothing stored, entry expired — because a caller looking for a passphrase should move on to the next source rather than fail.

ping

Check that an agent is actually listening, not merely that a file says so.

put

serve

Run an agent until it is asked to stop. Blocks.

shutdown

status