[P1] Implement authenticated local daemon API and IPC #29

New issue

Closed

opened 2026-07-18 00:02:34 +00:00 by lost-rob0t · 0 comments

lost-rob0t commented

2026-07-18 00:02:34 +00:00

(Migrated from github.com)

Goal

Expose control and query operations locally without trusting every process on the machine.

Requirements

Prefer a Unix-domain socket with owner-only permissions for Linux.
Authenticate clients and authorize control, query, export, and deletion operations separately where useful.
Bind no TCP listener by default.
Add request size, concurrency, and timeout limits.
Prioritize stop/privacy commands over query and model work.
Sanitize all errors and audit security-relevant requests.
Design a transport abstraction so a loopback API can be added deliberately later.

Acceptance criteria

Another local user cannot control or query the daemon.
Socket permissions and peer identity are validated at startup and per connection as supported.
Fuzzed malformed requests do not crash the daemon or leak content.
The CLI and status indicator use this API rather than direct internal imports.

Depends on

## Goal Expose control and query operations locally without trusting every process on the machine. ## Requirements - Prefer a Unix-domain socket with owner-only permissions for Linux. - Authenticate clients and authorize control, query, export, and deletion operations separately where useful. - Bind no TCP listener by default. - Add request size, concurrency, and timeout limits. - Prioritize stop/privacy commands over query and model work. - Sanitize all errors and audit security-relevant requests. - Design a transport abstraction so a loopback API can be added deliberately later. ## Acceptance criteria - Another local user cannot control or query the daemon. - Socket permissions and peer identity are validated at startup and per connection as supported. - Fuzzed malformed requests do not crash the daemon or leak content. - The CLI and status indicator use this API rather than direct internal imports. ## Depends on - #7 - #12 - #27