| 1 |
[package] |
| 2 |
name = "ops-exec" |
| 3 |
version = "0.1.0" |
| 4 |
edition = "2024" |
| 5 |
license = "MIT" |
| 6 |
description = "The trusted executor: run a typed, capability-gated step on a host and observe a host, over local exec, SSH, or an in-session agent. Trust root is SSH keys + Tailscale/Headscale only. Used by sando and bento." |
| 7 |
|
| 8 |
[features] |
| 9 |
default = [] |
| 10 |
# AgentRpc transport (the client half) — used by drivers that talk to ops-agent. |
| 11 |
rpc = ["dep:reqwest", "dep:rustls", "dep:serde_json", "dep:futures-util"] |
| 12 |
# The ops-agent binary (the on-host half). Pulls in the HTTP server + rpc. |
| 13 |
agent = ["rpc", "dep:axum", "dep:tokio-stream", "dep:tracing-subscriber", "dep:toml"] |
| 14 |
|
| 15 |
[dependencies] |
| 16 |
tokio = { version = "1.50.0", features = ["macros", "rt-multi-thread", "io-util", "fs", "process", "sync"] } |
| 17 |
async-trait = "0.1.83" |
| 18 |
serde = { version = "1.0.228", features = ["derive"] } |
| 19 |
anyhow = "1.0.102" |
| 20 |
thiserror = "2.0.18" |
| 21 |
tracing = "0.1.44" |
| 22 |
|
| 23 |
# rpc / agent only |
| 24 |
# `rustls-no-provider` rather than `rustls`: the latter is an alias for |
| 25 |
# `__rustls-aws-lc-rs`, which links a C crypto backend. The provider is ring |
| 26 |
# (pure Rust); `AgentRpc::new` installs it, so a consumer that has not chosen |
| 27 |
# one still gets a working client, and one that has keeps its own. |
| 28 |
reqwest = { version = "0.13", default-features = false, features = ["rustls-no-provider", "stream", "json", "query"], optional = true } |
| 29 |
rustls = { version = "0.23", default-features = false, features = ["std", "tls12", "logging", "ring"], optional = true } |
| 30 |
serde_json = { version = "1", optional = true } |
| 31 |
futures-util = { version = "0.3", optional = true } |
| 32 |
axum = { version = "0.8.8", optional = true } |
| 33 |
tokio-stream = { version = "0.1", optional = true } |
| 34 |
tracing-subscriber = { version = "0.3.22", features = ["env-filter"], optional = true } |
| 35 |
toml = { version = "1.1", optional = true } |
| 36 |
glob = "0.3.3" |
| 37 |
|
| 38 |
[[bin]] |
| 39 |
name = "ops-agent" |
| 40 |
path = "src/bin/ops-agent.rs" |
| 41 |
required-features = ["agent"] |
| 42 |
|
| 43 |
[dev-dependencies] |
| 44 |
tempfile = "3.20" |
| 45 |
tokio = { version = "1.50.0", features = ["macros", "rt-multi-thread", "time"] } |
| 46 |
|
| 47 |
[lints.rust] |
| 48 |
unused = "warn" |
| 49 |
unreachable_pub = "warn" |
| 50 |
|
| 51 |
[lints.clippy] |
| 52 |
pedantic = { level = "warn", priority = -1 } |
| 53 |
# Allow-list tuned from a measured breakdown across server/multithreaded/pter |
| 54 |
# (2026-07-22). These are the high-churn / low-signal pedantic lints; everything |
| 55 |
# else in `pedantic` stays a warning. Keep this block identical across repos. |
| 56 |
module_name_repetitions = "allow" |
| 57 |
# Doc lints. No docs-completeness push is underway. |
| 58 |
missing_errors_doc = "allow" |
| 59 |
missing_panics_doc = "allow" |
| 60 |
doc_markdown = "allow" |
| 61 |
# Numeric casts. Endemic and mostly intentional in size and byte math. |
| 62 |
cast_possible_truncation = "allow" |
| 63 |
cast_sign_loss = "allow" |
| 64 |
cast_precision_loss = "allow" |
| 65 |
cast_possible_wrap = "allow" |
| 66 |
cast_lossless = "allow" |
| 67 |
# Subjective structure and style nags. High churn, low signal. |
| 68 |
must_use_candidate = "allow" |
| 69 |
too_many_lines = "allow" |
| 70 |
struct_excessive_bools = "allow" |
| 71 |
similar_names = "allow" |
| 72 |
items_after_statements = "allow" |
| 73 |
single_match_else = "allow" |
| 74 |
# Frequent false-positives in TUI and router-heavy code. |
| 75 |
match_same_arms = "allow" |
| 76 |
unnecessary_wraps = "allow" |
| 77 |
type_complexity = "allow" |
| 78 |
|