term

Documentation

Overview

Package term gives the dashboard a real terminal, attached to a tmux session on the machine the builder runs on.

This is remote code execution, on purpose. It exists so an operator can run `claude`, `gh pr view`, `git log` or anything else an agent's work needs checking with, without leaving the page they are looking at — and every one of those is a shell command. There is no version of this feature that is not a shell.

So the posture is stated once, here, and enforced structurally:

• OFF unless BUILDER_TERMINAL=1. This ships inside a blueprint that other people generate applications from. A web shell that turned itself on because the plugin was installed would be indefensible.

• Local environments ONLY, by allowlist across APP_ENV, ENV and TOGO_ENV — the same three the auth plugin reads. Anything unrecognised, including unset, denies.

• Behind auth.Middleware + RequireRole("admin"), applied at the MOUNT in providers.go, and NOT MOUNTED AT ALL when the auth plugin is absent.

  This comment used to say "bound to the dashboard session, the same admin cookie that can edit personas" — which was false. No builder route is session-authenticated; the global chain is recovery, logging and CORS. An adversarial review caught it: the terminal was an unauthenticated shell, as this process, with its whole environment, on a port that binds to every interface. Stating a control is not implementing one, and this package is the worst possible place to confuse the two.

• Same-origin only. A WebSocket ignores CORS, so the Origin header is checked by hand — without that, any page the operator visits while logged in could open a shell on their machine.

tmux rather than a bare PTY because the point is persistence: a session keeps running when the tab closes, the API restarts, or a `claude -p` run takes twenty minutes. A bare PTY dies with the socket and takes the work with it.

Index

• type Service
  • func New(db *sql.DB, log *slog.Logger, workdir string) *Service
  • func (s *Service) Routes(r chi.Router)

Types

type Service

type Service struct {
	// contains filtered or unexported fields
}

func New

func New(db *sql.DB, log *slog.Logger, workdir string) *Service

func (*Service) Routes

func (s *Service) Routes(r chi.Router)

Routes mounts the terminal surface.

Session-authenticated by the router it is mounted under, exactly like the rest of the dashboard API — there is no separate token, because a weaker credential for a shell than for the settings page would be backwards.