CyberCoveLLC/Triple-C
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 47 Wiki Activity

AWS host phase 2b: SSM port-forward transport to the agent, and a Fargate-sized chown #78

Merged
jknapp merged 4 commits from feat/ssm-transport into main 2026-11-14 23:16:55 +00:00
Conversation 0 Commits 4 Files Changed 9
+2077 -30
4 Commits
Author SHA1 Message Date
shadowdaoandClaude Opus 5.5 7462cb05ec AWS spec: phase 2b measurements (SSM, Fargate start, health, re-attach)
Build App (Preview) / compute-version (pull_request) Successful in 5s
Details
Secret Scan / scan (push) Successful in 7s
Details
Secret Scan / scan (pull_request) Successful in 10s
Details
Build App (Preview) / create-release (pull_request) Successful in 2s
Details
Build Container / build-container (pull_request) Successful in 2m25s
Details
Build App (Preview) / build-macos (pull_request) Successful in 4m36s
Details
Build App (Preview) / build-windows (pull_request) Successful in 9m15s
Details
Build App (Preview) / test (pull_request) Successful in 10m59s
Details
Build App (Preview) / build-linux (pull_request) Successful in 15m27s
Details
Build App (Preview) / prune-previews (pull_request) Successful in 5s
Details 
Session stability, idle timeout and the keepalive that defeats it, Fargate
pull and start times with the chown fix, the ECS health check against the
agent, and what survives the app quitting. The SSM supervisor's drop reason
now carries the plugin's exit status as well as its last output line.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-11-14 12:08:12 -08:00
shadowdaoandClaude Opus 5.5 e3c81fd304 SSM transport: keep an Up tunnel busy so Session Manager's idle timeout never fires 
Measured: a silent port forward was cut at 19.7 minutes ("timed out due to
inactivity"), taking every connection through it with it. Every 5 minutes
the supervisor now sends an unauthenticated GET /v1/health through the
tunnel; the agent answers 401 before counting activity, so this keeps the
session alive without defeating idle auto-stop.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-11-14 10:48:29 -08:00
shadowdaoandClaude Opus 5.5 50f3d51946 SSM transport: end sessions whose open is cancelled; cache plugin creds 
Review fixes. A StartSession whose open future is dropped (a close racing a
reconnect, a caller timing out the first open) is now ended by a guard
instead of left to SSM's idle timeout. The plugin's credentials are cached
until 15 minutes before expiry, so a prompting credential_process is not
asked again on every reconnect. Fake-plugin tests run the script through
/bin/sh, so a parallel test's fork cannot fail the spawn with ETXTBSY.
CLAUDE.md: host/ssm.rs.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-11-14 10:15:04 -08:00
shadowdaoandClaude Opus 5.5 1e85b4d05f SSM port-forward transport to the agent (phase 2b), and a Fargate-sized chown 
host::ssm opens one AWS-StartPortForwardingSession to triple-c-agent in an
ECS task by running session-manager-plugin, supervises it, and reopens it
on the same loopback port when it drops, so an AgentEndpoint stays valid.
The StartSession token reaches the plugin through its environment, never
argv; the plugin gets the caller's credentials (and no other AWS_* vars)
so it can resume its own data channel. Unit tests drive the supervisor
with a fake plugin; ignored live tests run against a real task.

entrypoint.sh: chown only what is not already claude's. On Fargate,
/home/claude is the image's own copy, and chown -R copied all of it up:
the agent came up ~5.5 min after the container started; now 4 s.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-11-14 10:07:38 -08:00