feat(agent): run system install as root and attach to active session (VA-84) #89

Merged

Claude-Run merged 1 commit from feat/VA-84-system-root-session-attach into main

2026-06-29 14:46:08 +02:00

Claude-Run commented

2026-06-29 14:41:32 +02:00

Member

A system install ran the agent as the hardened, unprivileged vervain-agent user with ProtectHome=true, so it could not reach the logged-in user's Wayland socket, session D-Bus, or X authority. The desktop tab (KVM mode) was therefore dead on every system install; it worked only under a per-user install, and only for the user who ran it.

Run the system service as root with no sandbox and no dedicated user, then attach to the machine's active graphical session so the desktop tab drives the already-logged-in desktop regardless of who is logged in. Remove the ensure_vervain_agent_user / chown_state_dir machinery and the User=/Group=/ProtectHome/ProtectSystem (and the rest of the hardening) lines from the rendered system unit; state stays under /etc/vervain-agent and /var/lib/vervain-agent, owned by root. A least-privilege unit is out of scope; script a custom unit if needed.

Add active_session: on Linux, when running as root the agent discovers the active local session on seat0 via loginctl, then exports XDG_RUNTIME_DIR, DBUS_SESSION_BUS_ADDRESS, WAYLAND_DISPLAY, and XDG_SESSION_TYPE before any worker thread or the lazily-opened portal session starts, so ashpd/zbus connect to that user's session bus. With no active graphical session it leaves the environment untouched and logs a clear "desktop tab unavailable until a user logs in" status rather than crashing or shipping black frames. Per-user installs are a no-op (they already live in the session). X11 attach is deferred to VA-86; the display-manager greeter login is VA-85.

Replace the --system / --user boolean pair on install and uninstall with a single --install-type {user|system} clap ValueEnum, defaulting to system. The not-root hint now points at --install-type user.

Tests: pure parsers for the loginctl seat/session output, session selection (rejects remote/inactive/uid-less sessions, accepts State=active without the Active flag), and the Wayland socket scan; a unit guard that the rendered system unit has no User=/sandbox lines; and a source guard that the dedicated-user / chown helpers stay removed. README install docs updated.

#VA-84

Co-Authored-By: Claude Opus 4.8 (1M context) noreply@anthropic.com

A system install ran the agent as the hardened, unprivileged `vervain-agent` user with `ProtectHome=true`, so it could not reach the logged-in user's Wayland socket, session D-Bus, or X authority. The desktop tab (KVM mode) was therefore dead on every system install; it worked only under a per-user install, and only for the user who ran it. Run the system service as root with no sandbox and no dedicated user, then attach to the machine's active graphical session so the desktop tab drives the already-logged-in desktop regardless of who is logged in. Remove the `ensure_vervain_agent_user` / `chown_state_dir` machinery and the `User=`/`Group=`/`ProtectHome`/`ProtectSystem` (and the rest of the hardening) lines from the rendered system unit; state stays under `/etc/vervain-agent` and `/var/lib/vervain-agent`, owned by root. A least-privilege unit is out of scope; script a custom unit if needed. Add `active_session`: on Linux, when running as root the agent discovers the active local session on `seat0` via `loginctl`, then exports `XDG_RUNTIME_DIR`, `DBUS_SESSION_BUS_ADDRESS`, `WAYLAND_DISPLAY`, and `XDG_SESSION_TYPE` before any worker thread or the lazily-opened portal session starts, so ashpd/zbus connect to that user's session bus. With no active graphical session it leaves the environment untouched and logs a clear "desktop tab unavailable until a user logs in" status rather than crashing or shipping black frames. Per-user installs are a no-op (they already live in the session). X11 attach is deferred to VA-86; the display-manager greeter login is VA-85. Replace the `--system` / `--user` boolean pair on `install` and `uninstall` with a single `--install-type {user|system}` clap `ValueEnum`, defaulting to `system`. The not-root hint now points at `--install-type user`. Tests: pure parsers for the loginctl seat/session output, session selection (rejects remote/inactive/uid-less sessions, accepts `State=active` without the `Active` flag), and the Wayland socket scan; a unit guard that the rendered system unit has no `User=`/sandbox lines; and a source guard that the dedicated-user / chown helpers stay removed. README install docs updated. #VA-84 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Claude-Run added 1 commit

2026-06-29 14:41:32 +02:00

feat(agent): run system install as root and attach to active session (VA-84)

Check / fmt + clippy + tests (pull_request) Successful in 4m29s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

bb58cb399c

Run the system service as root with no sandbox and no dedicated user, then attach to the machine's active graphical session so the desktop tab drives the already-logged-in desktop regardless of who is logged in. Remove the `ensure_vervain_agent_user` / `chown_state_dir` machinery and the `User=`/`Group=`/`ProtectHome`/`ProtectSystem` (and the rest of the hardening) lines from the rendered system unit; state stays under `/etc/vervain-agent` and `/var/lib/vervain-agent`, owned by root. A least-privilege unit is out of scope; script a custom unit if needed.

Add `active_session`: on Linux, when running as root the agent discovers the active local session on `seat0` via `loginctl`, then exports `XDG_RUNTIME_DIR`, `DBUS_SESSION_BUS_ADDRESS`, `WAYLAND_DISPLAY`, and `XDG_SESSION_TYPE` before any worker thread or the lazily-opened portal session starts, so ashpd/zbus connect to that user's session bus. With no active graphical session it leaves the environment untouched and logs a clear "desktop tab unavailable until a user logs in" status rather than crashing or shipping black frames. Per-user installs are a no-op (they already live in the session). X11 attach is deferred to VA-86; the display-manager greeter login is VA-85.

Replace the `--system` / `--user` boolean pair on `install` and `uninstall` with a single `--install-type {user|system}` clap `ValueEnum`, defaulting to `system`. The not-root hint now points at `--install-type user`.

Tests: pure parsers for the loginctl seat/session output, session selection (rejects remote/inactive/uid-less sessions, accepts `State=active` without the `Active` flag), and the Wayland socket scan; a unit guard that the rendered system unit has no `User=`/sandbox lines; and a source guard that the dedicated-user / chown helpers stay removed. README install docs updated.

#VA-84

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>