feat(harness): auth mode + container path on the registry (phase 2) #16
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "feat-harness-registry-p2"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Phase 2 of
design/harness-descriptor.md— auth + the container path onto the shared registry.What
AuthModeper descriptor:AuthUnverified(default) /AuthHeader(claude) /AuthNone.harness.Writefails loudly if a token is supplied for anAuthUnverifiedharness — no more silently emitting a config that 401s. Localhost/stdio (no token) is unaffected, sowraptool initbehaviour is unchanged.Params.Dir(write location) +Token/CWDwired: claude rendersAuthorization: Bearer <token>when a token is set.bringUpGuixContainerwrites.mcp.jsonviaharness.Write("claude", …)— deletes the claude-onlywriteMCPConfig. Bonus: the container now gets merge-preserving writes (keeps your other MCP servers), matchingconnect.sh.harness.Write(claude)↔connect.sh(in the harness package); added auth-header,Dir-resolution, and fail-loud tests.Verified
E2E
up --runtime=guixwith anauth_token_file:.mcp.json=type:sse+?cwd=<host path>+Authorization: Bearer <token>. Fullgo test ./...+ golangci-lint clean.Next (phase 3): verify + set
AuthModefor the other harnesses,up --harness, addpi. (Phase 4:connect.shshells out towraptool init.)🤖 Generated with Claude Code
Phase 2 of design/harness-descriptor.md. Add a per-harness AuthMode (AuthUnverified default, AuthHeader for claude) and a Params.Dir (write location) / Token / CWD so harness.Write serves the networked container, not just localhost init. claude renders an Authorization: Bearer header when a token is set; Write fails loudly if a token is supplied for an AuthUnverified harness (instead of silently emitting a config that 401s). bringUpGuixContainer now writes .mcp.json via harness.Write("claude", ...) — deleting the claude-only writeMCPConfig reimplementation. The container gains merge-preserving writes (keeps other MCP servers) for free, matching connect.sh. The writeMCPConfig↔connect.sh parity test retargets to harness.Write(claude)↔ connect.sh in the harness package; added auth-header, Dir-resolution, and fail-loud tests. Verified e2e: `up --runtime=guix` writes type:sse + ?cwd= + Bearer from auth_token_file. Full go test ./... + golangci-lint clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>