- NewSession subscribes to bus "event" topic for chat log writing
- Remove makePublish/handler threading from all Submit call sites
- Adapt tests to new bus-based event delivery
p9File.Getattr was hardcoding 0666 for all files, breaking
permission visibility in per-session mounts. Use the actual
mode from the 9P stat response instead.
Remove hardcoded permission switch in makeStat and delegate to
the underlying FileTree.Stat() instead. This makes FileList in
sessionfile.go the single source of truth for session file modes.
- server.New takes server.Config (no more internal construction)
- OnRename removed: wstat handles all fid rewriting directly
- WithStrict/WithYolo removed (passed via ManagerConfig)
- Default dir functions moved to main.go
- tool.go and root.go in main package (wiring)
- Server is now a pure protocol handler
- session.go, sessionfile.go: moved to main package (lifecycle)
- store/tool.go, store/root.go: store constructors where they belong
- main_test.go: session tests in main package
- store/store_test.go: only store-level tests remain
- Removed: root.go, tools.go from main (moved to store/)
- Clean separation: store/ = abstraction, main = domain
DirStore.ListDir now uses listDirFn when set.
SessionManager wires ListDir through the hook so
session subdirectory listing works via the DirStore view.
OnRename callback already rewrites fid paths, so by the time
wstat's fid update runs, f.path has changed. Use relPath for
the new path computation instead of slicing f.path.
SessionManager no longer embeds *DirStore. Instead:
- SessionManager.Store() returns the DirStore view
- Server uses mgr.Store() in route table, mgr for lifecycle
- DirStore gains WithStat hook for custom stat logic
- Removed: RunnableStore interface, storeConfig type
- Tests updated to use .Store() for store operations
SessionStore accepts paths like id/file, id/t/tool, new, idx.
All /s/ dispatch logic removed from server handlers.
Remaining /s/ refs are metadata only (makeStat, fileOwnerGroup).
- SessionStore.Stat/Open/Delete/Rename/Create handle hierarchical paths
- SessionStore.ListDir for subdirectory listing
- Tool idx filtering moved into SessionStore.openEntry
- SessionStore.MkdirAll delegates to ToolStore
- Removed: sessionFileStore, sessionAllowTools, filterToolIndex,
OpenFiltered, storeReadCtx, storeBlockingRead from server.go
- routeStore passes full suffix (not pathBase) to stores
Session uname is now a numeric UID (>=10000) separate from the session
name. Rename no longer affects identity — the mount keeps working with
the same principal.
- SessionStore uses atomic.Uint32 for UID generation
- Session.Uname() returns the immutable principal
- SessionByUname() lookup for attach-time group assignment
- fileOwnerGroup uses principal, not session name
- WithMount() passed from createSession
Session files now have owner=session_id, group=agent. Permission
checking is enforced on open for session files only:
prompt/fifo.in: mode 0022 (group+other write, owner cannot)
ctl: mode 0222 (everyone can write)
Self-prompt rejection is now a natural consequence of the permission
model — the session (owner) has no write bit on its own prompt file.
Cross-agent prompting works via group 'agent' write bit. User access
works via 'other' write bit.
On attach, sessions are added to group 'agent', other users to 'user'.
Removed the explicit self-prompt check from clunk.
Store Uname from Tattach on each connection. Reject writes to
s/{id}/prompt when the connection's uname matches the target session
(self-prompt). Cross-agent prompting remains allowed.
Add ollie-9p-mount: a FUSE-to-9P proxy that attaches with a custom
uname derived from $OLLIE_SESSION_ID. Each session gets a transparent
mount — tools use ordinary file I/O and the identity is carried by the
underlying 9P connection.
Also adds a group registry (AddGroup/RemoveGroup/InGroup) on the server
for future access control use cases.
Levi Neely
Levi Neely
Ollie