[PR] fix(agent-isolation): re-ask the card a minute after a cached touch-policy "off" [magpie]

["potiuk (via GitHub)" <gi...@apache.org>]

potiuk opened a new pull request, #1723:
URL: https://github.com/apache/magpie/pull/1723

   ## Summary
   
   #1715 made the touch overlay skip the watcher when the card's signature and authentication touch policies are both `off`, and caches that answer for ten minutes.
   A cached `off` outlives `ykman openpgp keys set-touch aut cached`: for up to ten minutes the next signature waits for a touch with no window on screen, and fails with `agent refused operation` once gpg-agent gives up.
   The documented remedy, "re-run the command", does not help, since the re-run reads the same cache.
   
   Hit right after turning touch back on: two signed commits in a row failed that way, and the third went through only after the cached `touch-policy` file was deleted.
   
   The two answers are not equally safe to keep, which the script already says about unknown policies ("a false alarm costs a click, a missing window a silent block").
   So `on` keeps its ten minutes, and `off` is now trusted for one, long enough to cover a burst of git commands, short enough that turning touch on is noticed at once.
   
   - `tools/agent-isolation/gpg-touch-overlay.sh`: `TOUCH_POLICY_OFF_TTL_MIN=1`; a cached `off` older than that asks the card again.
   - `tools/agent-isolation/tests/test_gpg_touch_overlay.py`: a two-minute-old `off` with a card that now says `cached` arms (fails before the fix); a five-minute-old `on` is still trusted.
   - `docs/setup/secure-agent-setup.md`, `tools/agent-isolation/README.md`: the two TTLs, and where the cached answer lives for an immediate refresh.
   - `plugins/magpie-setup/skills/setup/setup_preflight/isolated_fingerprint.py`: re-stamped by the `isolated-setup-fingerprint` hook.
   
   ## Type of change
   
   - [x] Bug fix
   
   ## Test plan
   
   - `uv run pytest tests/test_gpg_touch_overlay.py` in `tools/agent-isolation`: 109 passed, 7 skipped (host-dependent: pgrep/ps visibility, Tk).
   - `test_a_cached_off_is_asked_again_after_a_minute` fails against the script on `main`.
   - `prek` clean on the changed files.
   
   ---
   
   🤖 Generated with [Claude Code](https://claude.com/claude-code)
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@magpie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] fix(agent-isolation): re-ask the card a minute after a cached touch-policy "off" [magpie]

["potiuk (via GitHub)" <gi...@apache.org>]

potiuk merged PR #1723:
URL: https://github.com/apache/magpie/pull/1723


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@magpie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org