Agent JIT approvals
Agents ask through Authsia. You grant a folder, capability, and TTL — then revoke from Access Center or a paired iPhone.
The same active agent grant follows that agent session into descendant directories of the directory that was approved. Sibling trees and symlink escapes do not inherit it. A grant approved at $HOME or / stays at that exact directory and does not cover children.
Scope
Named folder covers descendants, never ancestors or siblings. Root is root-only; workspace bindings select it explicitly with folder=%2F.
Allowed
JIT permits scoped list and exec only — with caller, TTL, and CLI checks.
Not JIT
access create makes reusable automation credentials. Separate path from JIT grants.
Human vs agent
TTY alone is not human auth. Eligible IDE terminals pair automatically through an app-displayed code bound to a host-derived TTY and live shell; the pairing survives cd. A paired human’s direct list reuses the normal session only when the Bridge reports that pairing for the current caller; the Bridge does not open Agent JIT for that pairing. Agent evidence still routes to JIT. When the Bridge already requires a list grant, the CLI still runs list JIT preflight even if it does not recognize the agent by name.
Post-exit file inspection
After an Agent JIT grant authorizes a secret-bearing exec or workspace run, Authsia inspects bounded observed files and automatically replaces eligible exact injected values plus supported one-layer Base64, URL-safe Base64, hexadecimal, percent/form, shell, HTML, and JSON representations. Each matched representation becomes <concealed by authsia>; surrounding content is preserved and encoded payloads are intentionally invalidated rather than left recoverable. Binary, non-UTF-8, oversized, and symbolic-link writes are skipped quietly. Recursive decoding and archive expansion remain outside this boundary. Ordinary human CLI sessions and reusable automation credentials do not start file observation or cleanup. A healthy event watcher inspects only event-reported file paths and ignores generated trees such as build and node_modules; bounded fallback discovery runs only when the watcher cannot start. Agent-granted cleanup has no flag or opt-out. Rewriting is descriptor-hardened but not crash-atomic, and no inspection or cleanup warning changes the child’s exit status.
For confirmed secret-bearing Agent JIT runs, Authsia also records best-effort outbound TCP and connected UDP endpoint metadata for the launched child and verified descendants. Access Center shows it under Activity → Network with explicit Observed, Partial, or Unavailable coverage. This is bounded investigation evidence — not traffic blocking or inspection — and never stores payloads, URLs, headers, DNS payloads, or secret values.