helper

Documentation

Overview

Package helper is part of the GoFastr harness.

See docs/harness-architecture.md for the architecture this package implements.

Package helper isolates provider credentials behind a small surface: callers ask for a *http.Header populated with Authorization (and any other secret headers) for a given provider+account; they never see the raw token.

The interface (Helper) admits two implementations:

1. InProcess — default for v0.1: the helper runs in the same process, reading from credstore.Store. Convenient for boot and tests; the agent's Bash tool can still in principle exfiltrate by reading the same credstore file (defense in depth comes from the Bash blocklist + redaction middleware).

2. Subprocess — landed in a later phase: a separate process holding tokens and serving sign-requests over a Unix socket. Agent has no in-memory access to tokens.

Tracked under operations hardening in the roadmap.

Index

• Variables
• type Helper
• type InProcess
  • func NewInProcess(store credstore.Store) *InProcess
  • func (h *InProcess) AttachAuth(req *http.Request, provider, account string) error
  • func (h *InProcess) Heartbeat() error

Variables

var ErrUnknownProvider = errors.New("helper: unknown provider")

ErrUnknownProvider is returned when AttachAuth is asked for a provider the helper doesn't know how to authenticate.

Types

type Helper

type Helper interface {
	// AttachAuth populates req.Header with Authorization (and any
	// other provider-specific secret headers) for the given account.
	// Returns ErrUnknownProvider if the account is not present.
	AttachAuth(req *http.Request, provider, account string) error

	// Heartbeat reports whether the helper is alive. Used by the
	// /health slash command + supervisor.
	Heartbeat() error
}

Helper attaches secret headers to outbound provider requests.

type InProcess

type InProcess struct {
	// contains filtered or unexported fields
}

InProcess is the v0.1 same-process implementation backed by credstore.Store. Concurrency-safe.

func NewInProcess

func NewInProcess(store credstore.Store) *InProcess

NewInProcess returns an InProcess Helper.

func (*InProcess) AttachAuth

func (h *InProcess) AttachAuth(req *http.Request, provider, account string) error

AttachAuth implements Helper.

For OpenAI-compatible providers (openrouter, zai) the secret is the bearer token. Copilot will land in v0.2 with its own header set derived from the exchanged Copilot internal token.

func (*InProcess) Heartbeat

func (h *InProcess) Heartbeat() error

Heartbeat implements Helper. InProcess always returns nil — the "helper" is just a method receiver, so it's healthy as long as the host process is.