kyleandClaude Opus 5.5
5e55fe4c66
Task 04 added dependencies to toolkit and its git add line left out the lock file, so the driver stopped on an unclean tree. The lock change is folded into task 04's commit. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
57 lines
2.2 KiB
Markdown
57 lines
2.2 KiB
Markdown
# M3b task 13: `brokerd serve` uses the runtime
|
|
|
|
**Branch:** `m3b` (run `git switch m3b`; `git status --short` must be empty, otherwise stop)
|
|
**Commit subject:** `brokerd serve: run tools in containers when [runner] is set`
|
|
|
|
## Goal
|
|
|
|
With a `[runner]` section, `brokerd serve` runs allowed calls through `Podman`; without it, it keeps
|
|
M3a's `Refusing` runtime. It prints one line saying which, so the owner can see it at a glance.
|
|
|
|
## Files
|
|
|
|
- Copy: `crates/brokerd/tests/serve_runner.rs`
|
|
- Modify: `crates/brokerd/src/main.rs`, `docs/implementer-log.md`
|
|
|
|
## The change
|
|
|
|
In `main.rs`, after the config is loaded and before `serve::start`:
|
|
|
|
```rust
|
|
let log: Arc<dyn Fn(&str) + Send + Sync> = Arc::new(|line: &str| eprintln!("{line}"));
|
|
```
|
|
|
|
and choose the runtime and its notice:
|
|
|
|
- `cfg.runner` is `Some(runner)` → `Box::new(Podman::new(runner, cfg.egress_dir(), Arc::clone(&log)))`,
|
|
notice `brokerd: tools run in containers from {runner.image}` (take the image before `runner`
|
|
moves).
|
|
- `None` → `Box::new(Refusing)`, notice `brokerd: no [runner] section: every tool call is refused`.
|
|
|
|
Pass the runtime and `log` to `serve::start` (instead of `Box::new(Refusing)` and the closure made
|
|
there today). Print the notice with `eprintln!` right after the existing
|
|
`brokerd: serving tools on … and approvals on …` line. Nothing else changes.
|
|
|
|
## Steps
|
|
|
|
- [ ] **1. Copy.** `git switch m3b`, then
|
|
`cp docs/plans/M3b/files/crates/brokerd/tests/serve_runner.rs crates/brokerd/tests/`
|
|
- [ ] **2. See it fail.** `cargo test -p brokerd --test serve_runner`. Expected: 2 fail (the
|
|
notices are missing, and the call is refused).
|
|
- [ ] **3. Make the change.** Run `cargo fmt --all`.
|
|
- [ ] **4. See it pass.** `cargo test -p brokerd --test serve_runner --test serve`. Expected: 2
|
|
and 9 passed.
|
|
- [ ] **5. Run the gate.** `make gate`. Expected last line: `gate: ok`, with about 638 tests in
|
|
all.
|
|
- [ ] **6. Log and commit.** `git add crates/brokerd docs/implementer-log.md Cargo.lock && git commit`
|
|
|
|
This is the last task of M3b. Stop after the commit; the review comes next.
|
|
|
|
## Done when
|
|
|
|
- `cargo test -p brokerd` passes; `make gate` prints `gate: ok`.
|
|
|
|
## Stop and report if
|
|
|
|
- `serve::start`'s signature would have to change.
|