Repository navigation
feat(serve): run a daemon across machines: TLS, reconnect, restarts, per-client tokens - #197
Merged
Merged
Conversation
…per-client tokens fuseraft serve can now be attached to from another machine and survive the things that happen there: dropped connections, restarts on either side, and more than one client with different rights. - --tls-cert/--tls-key serve /mcp, /attach and A2A over https/wss, printing the certificate's SHA-256 fingerprint; plain HTTP beyond loopback warns. - A Fuseraft-Client-Id header makes a client outlive its connection: a pending approval is asked again on reconnect within --reconnect-grace (default 60 s), and results that finished meanwhile are delivered. WebSocket keepalive notices peers that vanish without closing. - The queue is saved to ~/.fuseraft/state/<project>/serve-queue.json. After a crash or restart the running task resumes from its saved session and the queued ones follow; a task interrupted more than 3 times fails. SIGTERM shuts down like Ctrl+C, and a stopping daemon denies a pending approval instead of waiting on it. - --tokens-file gives each client a named token, re-read on change; removing or rescoping one closes its connections. Client ids are kept per token. A `read` token watches over /attach and can call get_status/get_result, but can't dispatch. - fuseraft attach --url takes --cert-sha256 to pin a self-signed certificate and --client-id to pick a running task back up. Fixes found along the way: a pidfile naming the daemon's own PID (PID 1 in a container) blocked every restart after a crash, and a replaced WebSocket connection was never actually closed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Makes
fuseraft serveusable from another machine, and keeps its work through dropped connections, restarts on either side, and clients with different rights.New
--tls-cert/--tls-key(PEM, or.pfxwithFUSERAFT_SERVE_TLS_PASSWORD) serve/mcp,/attachand the A2A endpoints overhttps:///wss://. The daemon prints the certificate's SHA-256 fingerprint and warns when it serves plain HTTP beyond loopback.Fuseraft-Client-Idkeeps its tasks across connections: a pending approval is asked again when it reconnects within--reconnect-grace(default 60 s), and results that finished while it was away are sent on return.hellogainsclientId,readOnly,inFlightandpendingResults;resultgainstask. Pings every 15 s notice peers that vanish.~/.fuseraft/state/<project>/serve-queue.json(mode 600). After a crash or restart, the running task resumes from its saved session (broadcast astask_resumed) and the queued ones follow, each still owned by its client. A task interrupted more than 3 times is failed. SIGTERM now shuts down like Ctrl+C.--tokens-fileholdsname token [full|read]lines (chmod 600 enforced), re-read on change. Removing or rescoping a token closes its connections within seconds, and client ids are scoped per token. Areadtoken can watch over/attachand callget_status/get_result;dispatch_taskis hidden and refused.fuseraft attach --urltakes--cert-sha256to pin a self-signed certificate and--client-idto pick a running task and its approval back up. With a read token, it only watches.Fixed
--unattended-policysays; the task asks again when it resumes.Docs
serve.md, cli-reference.md, protocol.md and security.md cover the new flags, events and trust model.
Testing
New tests for the attach clients, the queue journal, tokens (including scope and revocation over a real WebSocket and real MCP), TLS loading and pinning, and the pidfile. Also run live against a daemon in a container with real model calls: SIGKILL and SIGTERM mid-task followed by a resume, client pickup after a detach, token revocation, read-only tokens over attach and MCP, and fingerprint pinning.