fix: interactive Realm password, recoverable worker budget (0.9.15)

Prompt for Realm password when CST_REALM_PASSWORD is unset; map worker
request-gate exhaustion to a clear budget error with partial progress;
hard-skip identical tool failures after 3 tries. Add docs/parliament.md.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
WHC
2026-10-29 10:53:36 +08:00
co-authored by Cursor
parent 9c6257fc96
commit e610d70c30
10 changed files with 194 additions and 31 deletions
+10 -1
View File
@@ -52,7 +52,7 @@ static void usage(const char *argv0) {
" --no-orchestrate override workspace orchestration setting\n"
" --realm-new create Realm file keys (legacy/dev)\n"
" --realm-password-init create password-derived Realm (no sk on disk)\n"
" --login unlock; claim chair; start parliament service\n"
" --login unlock (CST_REALM_PASSWORD or prompt); claim chair\n"
" --service run parliament service (discover+context sync)\n"
" --service-fg same as --service, stay in foreground\n"
" --service-stop stop the parliament background service\n"
@@ -754,7 +754,12 @@ int main(int argc, char **argv) {
char rdir[OS_PATH_MAX];
if (cst_realm_dir(rdir, sizeof(rdir)) == 0 &&
cst_realm_is_password_mode(rdir) && !cst_parliament_session_ok(NULL, 0)) {
char pwbuf[256];
const char *pw = getenv("CST_REALM_PASSWORD");
if ((!pw || !pw[0]) && isatty(0) &&
cst_prompt_secret("Realm password to open agent (hidden): ", pwbuf,
sizeof(pwbuf)) == 0)
pw = pwbuf;
if (pw && pw[0]) {
const char *iid = parliament_instance ? parliament_instance
: getenv("CST_INSTANCE_ID");
@@ -765,6 +770,8 @@ int main(int argc, char **argv) {
cst_parliament_login(pw, iid, realm_label, err, sizeof(err));
if (!hand) {
fprintf(stderr, "%s\n", err[0] ? err : "login required");
if (pw == pwbuf)
memset(pwbuf, 0, sizeof(pwbuf));
curl_global_cleanup();
return 1;
}
@@ -773,6 +780,8 @@ int main(int argc, char **argv) {
sizeof(err)) != 0)
fprintf(stderr, "warning: parliament service: %s\n",
err[0] ? err : "start failed");
if (pw == pwbuf)
memset(pwbuf, 0, sizeof(pwbuf));
} else {
fprintf(stderr,
"password Realm active: run --login (or set "