fix(service_codescalers): require --root, refuse per-user start #140

Merged

mahmoud merged 2 commits from development_codescalers_root_only into development

2026-04-27 06:02:39 +00:00

mahmoud commented

2026-04-27 06:00:48 +00:00

Owner

Why

hero_codescalers is a per-server admin tool: one instance per host, owned by root, with TCP access gated by in root's hero_proc secret store. Per-user instances each get their own secret store and their own admin list, defeating the single-admin-gate model.

Change

now refuses without , with an actionable error pointing to the right command. Stops anyone (including future me) from accidentally provisioning a per-user instance that cannot integrate with the host-wide whitelist.

Surfaces during issue lhumina_code/hero_codescalers#8 stack verification.

## Why hero_codescalers is a per-server admin tool: one instance per host, owned by root, with TCP access gated by in root's hero_proc secret store. Per-user instances each get their own secret store and their own admin list, defeating the single-admin-gate model. ## Change now refuses without , with an actionable error pointing to the right command. Stops anyone (including future me) from accidentally provisioning a per-user instance that cannot integrate with the host-wide whitelist. ## Related Surfaces during issue https://forge.ourworld.tf/lhumina_code/hero_codescalers/issues/8 stack verification.

mahmoud added 1 commit

2026-04-27 06:00:48 +00:00

fix(service_codescalers): require --root, refuse per-user start

Build and Publish Skills / build-and-publish (pull_request) Successful in 3s

Details

7863023f27

hero_codescalers is a per-server admin tool: one instance per host, owned by
root, with TCP access gated by ADMIN_SECRETS in root's hero_proc secret store.
A per-user instance has its own secret store and admin list, defeating the
single-admin-gate model.

Refuse to start without --root (clean error with the right command), rather
than silently provisioning a per-user instance that cannot integrate with the
host-wide admin whitelist.

lhumina_code/hero_codescalers#8

mahmoud added 1 commit

2026-04-27 06:02:31 +00:00