kayg/infraternal-v0
Archived
Watch
1
0
Fork
You've already forked infraternal-v0
 0
Code Issues 92 Pull requests Projects Releases Packages Wiki Activity Actions

Carry generic resource options through stream OPEN #59

Open
opened 2026-10-04 17:44:28 +00:00 by kayg · 0 comments
kayg commented 2026-10-04 17:44:28 +00:00
Owner
Copy link

Problem and evidence

crates/server/src/host_route.rs:580-643 reconstructs provider stream grants only for legacy container Logs and Exec OPENs, with selector: None and previous: false. crates/host-resource-client/src/wire.rs:155-163 likewise serializes only Logs and Exec. Other provider stream capabilities cannot carry their resource address, operation, selector or versioned options through this route.

Recommendation

Add a negotiated generic resource OPEN that carries the exact address, operation, versioned options and selector under the existing signed grant. Reuse the current WebSocket, credit, priority and session-lifecycle machinery.

Payoff and estimate

Provides remote parity for the capabilities the product already approves without another data path. Estimate: 3–5 engineering days, including embedded/mTLS tests and preserving existing container OPEN behavior.

Priority: Next milestone (PLAN step 5).

2026-10-04 owner decisions: Matches the custom v1 tunnel and the requirement to unify embedded and remote paths. Keep one WebSocket path and existing authorization, replay and revocation checks. Related: #49.

Report: arch-review report
Source: arch-review 2026-10-04

## Problem and evidence `crates/server/src/host_route.rs:580-643` reconstructs provider stream grants only for legacy container Logs and Exec OPENs, with `selector: None` and `previous: false`. `crates/host-resource-client/src/wire.rs:155-163` likewise serializes only Logs and Exec. Other provider stream capabilities cannot carry their resource address, operation, selector or versioned options through this route. ## Recommendation Add a negotiated generic resource OPEN that carries the exact address, operation, versioned options and selector under the existing signed grant. Reuse the current WebSocket, credit, priority and session-lifecycle machinery. ## Payoff and estimate Provides remote parity for the capabilities the product already approves without another data path. Estimate: 3–5 engineering days, including embedded/mTLS tests and preserving existing container OPEN behavior. **Priority:** Next milestone (PLAN step 5). **2026-10-04 owner decisions:** Matches the custom v1 tunnel and the requirement to unify embedded and remote paths. Keep one WebSocket path and existing authorization, replay and revocation checks. Related: #49. **Report:** [arch-review report](/mnt/hdd/infraternal/jobs/arch-review/report.md) **Source: arch-review 2026-10-04**
Commenting is not possible because the repository is archived.
No Branch/Tag specified
Branches Tags
main
dev
perf-gates
provider-docker-podman
fix-networkidle
fix-apierror-panics
fix-revoke-panic
wal-race
fix-private-storage
provider-runtime
plugin-design
server-channels
scope-v01
deploy-git-fix
sec-hardening
gates-tiering
sidebar-sync
multi-tab
cli-eof
podman-flake
ssh-reattach
agent-tunnel
process-boundary
shadcn
stream-params
cli-ssh
ssh-product
container-live
flaky-tests
s1-e2e
ssh-test-isolation
cli-stream
research-lxc
container-live-agent
ui-apis
grant-shrink
deploy-o2
ui-redesign
migration-fix
cli
stream
No results found.
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
kayg/infraternal-v0#59
No description provided.