Replace HMAC-based registration with proper 9P Tauth flow:
- First client to connect sets the secret via Tauth afid write
- Server stores secret in memory, returns session token
- Subsequent clients must provide matching secret
- Secret never in env vars or disk, only transmitted over socket
Changes:
- server9p.go: Authenticate() replaces RegisterAgent/GetAgent
- client9p.go: Dial() does Tauth handshake (write secret, read token)
- spawn.go: generates secret, no longer passes via TOOLSRV_SECRET env
- auth9p.go: simplified to just GenerateSecret()
- spec9p.go: removed /register file, token validation at connection level
- cmd/toolsrv/server.go: handleAuth/handleAuthWrite/handleAuthRead
Security model:
- Session generates secret on Spawn()
- All agents share session's secret via ProcessKeeper
- Socket permissions (local) or SSH (remote) protect transport
- Secret dies with toolsrv process, new secret on respawn
Added integration tests verifying:
- First connection sets secret
- Reconnect with same secret works
- Wrong secret rejected
- ProcessKeeper reconnect/respawn behavior
- Concurrent connections
- spec9p.go: fsedsl-based namespace specification
- ToolsrvCtx with Server, Agent, Proc
- Handlers as package-level functions
- Follows fs/spec.go pattern
- server9p.go: simplified to state management only
- Agent registration with HMAC tokens
- BuildTree() creates fsedsl tree
- Removed redundant 9P protocol handling
The 9P protocol serving will use the same pattern as olliesrv
(cmd/olliesrv/server.go), which takes a *fsedsl.Tree and handles
all 9P message types generically.
New files:
- fs9p.go: FS9P struct with /proc-based execution model
- /proc/new (rdwr): blocking tool execution
- /proc/new.bg: background/detached execution
- /proc/<pid>/out, wait, stat, ctl: process management
- /tools, /ctl, /info: tool registry and host info
- Payload format: key=value lines, newline delimited
- exec9p.go: Decoupled tool execution
- ExecuteTool: standalone function for tool execution
- executeSandboxed: sandbox execution without Server deps
- executeBypassDirect: bypass broker without Server deps
- fs9p_test.go: Unit tests for FS9P
Design notes:
- Background execution is the internal model
- Foreground (/proc/new rdwr) blocks until completion
- No per-connection state (cwd/env passed per-call or at attach)
- Session ID scoping via registry, not env propagation
This is the foundation - actual 9P serving and integration pending.
- doc/boot-sequence.md: init chain from main → fs.NewRoot → session.Init
- Event protocol: comprehensive table on Event struct (all roles, semantics)
- RPC server moved from cmd/ollie-remote into toolsrv/rpcserver.go
(binary is now a 93-line thin wrapper)
- SetSessionEnv folded into NewAgent (no post-construction wiring needed)
- AgentCfg → AgentParams (distinguish from AgentConfig JSON schema)
- ToolResult/ToolResultContent shared types in toolsrv/rpcwire.go
- toolsrv/shell.go → toolsrv/exec.go (name matches purpose)
- Resume unified: single path, always through Keeper
- AGENTS.md: fix fs/builder.go → fsedsl/builder.go, handlers_*.go
- fsedsl/Tree: document dual-mode (EDSL lazy vs Manual Mount)
- Truncation stack documented at defaultToolResultMaxBytes
- Integration test rewritten to use srv.ServeRPC directly
The sandbox escape mechanism is a bypass, not privilege elevation.
The old name caused the agent to confuse it with sudo.
- elevate/ → bypass/ (package, types, tests)
- elevate_notify.go → bypass_notify.go
- Namespace: /elevate → /bypass, session/*/elevate → session/*/bypass
- Tool arg: "elevated" → "bypass"
- Env: OLLIE_ELEVATE_SOCKET → OLLIE_BYPASS_SOCKET
- File: elevate-policy.yaml → bypass-policy.yaml
- All docs, prompts, and scripts updated
toolsrv:
- Merge rpc.go into conn.go (wire types already there)
- Merge tools.go + discover.go into registry.go
- Merge accessors.go into server.go
- 4 files eliminated
fs:
- HandlerCtx.Context now carries the session context (set via
sessionBindings Applier). Previously it was the daemon context
which never cancels — handlers checking ctx.Done() now properly
detect session kill/pause.
- Session-scoped blocking handlers (streamAgentChat, blockAgentStateWait)
merge session context with per-read timeout via mergeCtx(). A session
kill now immediately unblocks readers without waiting for the 5s timeout.
- Remove redundant manual AfterFunc in blockAgentStateWait.
session:
- Remove unused _ string parameter from WaitEvent
The agent always talks to a *Conn (never a *Server directly).
Replace the Runner interface with the concrete type throughout:
- Runtime.ToolServer is now *toolsrv.Conn
- BuildRuntime takes *toolsrv.Conn
- session.Config, SessionInfra, InfraConfig use *toolsrv.Conn
- All inline type assertions in agent.go deleted — methods called
directly on *Conn (SetEnv, SetCWD, Close, Detach, ListDetachedRaw,
SignalDetached, GetDetachedOutput, DismissDetached, SetAllowTools,
SetOnToolsChanged, Ping, ToolRegistryRevision)
- Added Conn.ToolRegistryRevision() that returns 0 (remote connections
don't support revision tracking; use push-based OnToolsChanged instead)
- Deleted the Runner interface and its test
- Renamed LoadToolOnRunner → LoadToolOnConn
The entire classifier indirection (interfaces, type assertions, RPC
methods for classification, closure wrappers in BuildRuntime) is replaced
by a simple map[string]ToolInfo on Runtime.
The .meta file is read once into ToolInfo. The loop reads fields directly:
rt.ToolMeta[name].ReadOnly (was: rt.CanParallelize(name))
rt.ToolMeta[name].Tier (was: rt.MemoryTier(name, args))
rt.ToolMeta[name].OutputFormat (was: rt.OutputFormat(name))
rt.ToolMeta[name].ResetsCounter (was: rt.ResetsCounter(name))
Removed: ParallelClassifier, MemoryTierClassifier, OutputFormatClassifier
interfaces, toolClassifier type, and all closure-wrapping in BuildRuntime.
The RPC methods on Server/Conn stay (used by ollie-remote) but the agent
no longer routes through them.
- Kill agentConfig struct. run() takes (*Runtime, TurnCtx, state) directly.
TurnCtx holds only 7 per-turn closures; stable config reads come from Runtime.
- Lazy tool refresh: toolsNeedRefresh() checks ToolRegistryRevision() on the
tool server. Skips ListTools IPC when registry hasn't changed. Remote Conn
falls back to always-refetch (same as before).
- AgentConfig.GenParams() method replaces the 16-line manual field copy in
BuildRuntime.
- Remove CfgBackend/CfgModel from Runtime. Callers read cfg.Backend/cfg.Model
directly since they already have the AgentConfig in scope.
The system prompt tool listing now refreshes immediately on tool_load
instead of only on file-watcher events. buildToolListing helper added
to format the listing in the same format BuildPreamble uses.
Also updates kde submodule: GUI auto-switches to newly created agent,
removes remote field from agent dialog.
Tools like file_write, file_edit, and shell now reset the agent's step
counter when called successfully. This allows the agent to continue
working without hitting the soft step-budget guardrail as long as it's
making active progress (writing files, running commands) rather than
looping on research/reading.
Changes:
- Add ResetsCounter bool to ToolInfo and MetaFile structs
- Parse resetsCounter from .meta JSON files
- Reset step counter in agent loop when ResetsCounter tool succeeds
- Add resetsCounter: true to file_write, file_edit, shell
- Reduce maxSteps from 50 to 25 (resetsCounter makes this safe)
- Remove all OLLIE_*_PATH vars (TOOLS_PATH, CFG_PATH, DATA_PATH, etc.)
Use XDG_CONFIG_HOME/ollie/* and XDG_DATA_HOME/ollie/* instead
- Replace OLLIE_<TAG>_LOG per-component logging with single OLLIE_LOG={level}
- Replace OLLIE_USAGE_LOG with XDG_DATA_HOME-based path
- Replace OLLIE_OLLAMA_URL with standard OLLAMA_HOST (or omit entirely)
- Rename protocol markers: OLLIE_LISTEN_READY → ListenReady, OLLIE_9P_OPEN → Open
- Remove freeloader hooks from agent configs
- Update sandbox YAMLs to use XDG paths instead of OLLIE_*_PATH tokens
- Update shell tools to use $(dirname "$0") fallback instead of OLLIE_TOOLS_PATH
- Update docs and prompts accordingly
callPromotedTool was hardcoding timeout=30 and sandbox="default" for all
promoted tool executions, ignoring the timeout and sandbox parameters
provided by the agent in tool call args. Extract these from the JSON args
map (same pattern as elevated) and pass them through to the execution
functions.
- Removed from env.go managed list and defaults map
- main.go and shell.go derive path from XDG_RUNTIME_DIR directly
- main.go sets OLLIE_ELEVATE_SOCKET in process env for subprocesses
- Stripped OLLIE_TOOLS_PATH, OLLIE_AGENTS_PATH, OLLIE_SKILLS_PATH,
OLLIE_PROMPTS_PATH, OLLIE_MEMORY_PATH, OLLIE_TMP_PATH from managed
list and defaults in env.go
- ToolsPath(), SkillsPath(), PromptsDirs(), AgentsDirs(), ollieTmpDir()
now derive from paths.CfgDir()/paths.DataDir() directly
- Removed shell-exec fallback from resolveExecPrompt() — only file
resolution remains
- Cleaned up env_test.go to match reduced managed set
- Updated stale comments referencing /home/lkn/.config/ollie/tools
- Skip SetupToolServer for paused sessions during restore
- Pause() and Resume() now persist state to disk
- Resume() sets up tool server from scratch for sessions restored paused
- IsConnected() returns false when paused
- Add SetPaused(), SetToolServer() methods
- ProcessKeeper.SetContext() for resume after pause
- Session index sorts active-first, paused-last
- CreateAgent accepts name= parameter
- Remove duplicate SetCwd method
ProcessKeeper maintains a running ollie-remote process and respawns
it on failure. Multiple agents Dial() the same keeper to get
independent connections. If the process dies, the next Dial()
triggers a respawn (up to 3 attempts with backoff).
All session creation and restore paths now use ProcessKeeper.
Kill/Shutdown close the keeper (which closes the current process).
This fixes 'connection closed' errors persisting indefinitely
after ollie-remote crashes — the next tool call respawns it.
Remove hardcoded ~/.config/ollie/tools path and XXX hack.
Local ollie-remote now inherits OLLIE_TOOLS_PATH from the environment
via os.Environ(), same as remote bootstrap sets it explicitly.
ToolsPath() reads OLLIE_TOOLS_PATH with fallback to ~/.config/ollie/tools.
Tools added to the directory are picked up immediately on next
tool_load — no restart needed.
Removed dead appendEnvVar helper.
With the zero-tools transition complete, the tools/builtin/ package
served no purpose — Builtins() returned nil. Removed:
- tools/builtin/builtins.go and the directory
- builtins field, WithBuiltins, Dispatch from toolsrv.Server
- Handler type from toolsrv (only used by builtins)
- OnPreDispatch/WithOnPreDispatch (dead code)
- Strict field and WithStrict (dead code, never read)
- CallTool simplified — no fallback to Dispatch
- builtin import and WithBuiltins/WithStrict calls from ollie-remote
- tools/builtin from justfile build/test targets
Updated AGENTS.md, ARCHITECTURE.md, README.md, EVOLUTION.md
skill_list and skill_load are now external shell scripts (data/tools/).
Removed from builtins: SkillList, SkillLoad, SkillActive.
Removed: toolsrv/skills.go, tools/builtin/skill.go, WithSkillsRegistry,
SkillsRegistry accessor, ListSkillsTools.
ollie-remote no longer initializes a skills registry.
The demarcation: built-ins mutate agent internals (tool schema, context
injection). Skills are just file reads — no special treatment needed.
Execution is now identical for local and remote:
- Session calls Spawn()/SpawnRemote() → owns *Process with socket
- Clients call Dial(LocalAddr(socket)) → *Conn over Unix socket
- ollie-remote serves --listen mode with multi-client accept loop
- Builtins (shell, tool_load, skill_load) run in subprocess with registries
Lifecycle:
- Pdeathsig ensures children die with parent (no orphans)
- Cleanup: SIGTERM → 3s grace → SIGKILL (guaranteed)
- Socket paths use atomic counter for uniqueness
- Session Kill() closes Process
Protocol:
- Extended RPC: set_env, set_cwd, detach, list_detached, etc.
- Shell goes through builtin dispatch (parses 'cmd' field correctly)
- Streaming output via JSON-RPC notifications
Before each CallTool, check if the local ollie-remote binary hash
differs from what was deployed. If so, close the SSH connection,
re-dial (triggering bootstrap to upload the new binary), and swap
the connection transparently.
Emits info events when upgrade is detected and when it completes.
The bootstrap script now also checks for and deploys the landrun
sandbox binary to ~/.cache/ollie/bin/landrun on the remote host.
Without this, ollie-remote couldn't sandbox tool execution.
Protocol extended: OLLIE_LOADER_START now includes need_landrun field.
Transfers are sequential: ollie-remote first, then landrun if needed.
Each binary has independent hash-based caching.
- Skip cwd existence check when remote is specified (cwd is on remote)
- Add BatchMode=yes to SSH: pubkey-only, no password fallback
- Add StrictHostKeyChecking=accept-new: auto-accept new hosts, reject
changed keys
- Deploy failure already propagates as session creation error via
RemoteDial returning error
ollie-9p computes its namespace path from $USER and $DISPLAY via
client.Namespace(). When run inside the sandboxed shell, USER was not
guaranteed to be in the environment, producing /tmp/ns..:0/ollie.
Fix: explicitly inject USER into envExtra in SetSessionEnv (alongside
OLLIE_SESSION_ID and OLLIE_UNAME). Also export the computed NAMESPACE
to cmd.Env so ollie-9p can use it directly without recomputing.
Adds system_logs with two variants:
- journalctl (systemd hosts): unit, since, lines, grep
- dmesg (any Linux): source, lines, grep
Both declare sudo: true — privilege escalation is handled by dispatch.
Also adds OR support in match conditions: array values mean any must
pass. Combined with AND across keys:
{"binary": ["journalctl", "systemd-cat"], "os": "linux"}
= (journalctl OR systemd-cat) AND linux
A .meta file can now declare multiple variants, each gated by match
conditions. The first variant where all conditions pass determines the
tool's schema, documentation, and executable. If no variant matches,
the tool is hidden from the registry on that host.
Match conditions:
binary — exec.LookPath or absolute path stat
file — os.Stat (file or dir exists)
os — runtime.GOOS
arch — runtime.GOARCH
env — environment variable is non-empty
nenv — environment variable is empty
This enables network-transparent tool declarations: one .meta file
works across heterogeneous hosts (systemd vs syslog, apt vs pacman,
GUI vs headless). When ollie-remote deploys to a different machine,
tools adapt their contract to what's actually available.
No variants field = current behavior, zero breaking changes.
Tools no longer need to be co-located in $OLLIE_TOOLS_PATH. The .meta
sidecar can specify a cmd field pointing to any executable:
- Absolute path: use directly
- Bare name: resolve via $PATH
Resolution order: OLLIE_TOOLS_PATH/<name> → meta.cmd → PATH lookup.
Local wrappers always win, enabling simplified interfaces over complex
system binaries.
Rewrites doc/WRITING_TOOLS.md to document the plugin model: any
executable + .meta = tool, no source tree integration required.
The Registry had its own discover() method that still required
'ollie:prompt' in file content — the old header-based check that was
removed from DiscoverTools(). This caused tool_load to fail for ALL
tools (not just Go binaries) since .meta is now the sole metadata source.
Fix: delegate to DiscoverTools() which correctly scans .meta files.
Levi Neely
Ollie Agent