Repository navigation
feat(smb): share the graph's file tree read-only over SMB - #305
Merged
Merged
Conversation
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VkWr32dEQW7JiHkWwaAwSu
…, worker and tree tests Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VkWr32dEQW7JiHkWwaAwSu
…ing .env Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VkWr32dEQW7JiHkWwaAwSu
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VkWr32dEQW7JiHkWwaAwSu
adeelahmad
force-pushed
the
claude/project-thread-ctpu0l
branch
from
October 10, 2026 22:05
cd5567a to
83c76bf
Compare
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VkWr32dEQW7JiHkWwaAwSu
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VkWr32dEQW7JiHkWwaAwSu
adeelahmad
marked this pull request as ready for review
October 11, 2026 00:59
This was referenced Oct 11, 2026
adeelahmad
added a commit
that referenced
this pull request
Oct 11, 2026
…monitoring switch as built (#351) "Ask" names the built-in Telegram bot (#293) and Slack app (#287); "Connect your agents" adds mounting the graph's files read-only over S3, WebDAV, NFS or SMB (#324, #295, #305) and copying the MCP address from the account menu (#340); "Watch it run" says one switch in the web app starts Prometheus and Grafana (#337); "Light by default" adds the cloud model presets (#334). The docs index gains the NFS and SMB pages, and "In progress" keeps only open PRs. Claude-Session: https://claude.ai/code/session_01HDx7PPUauyjMn1LZs8JAsS Co-authored-by: Adeel Ahmad <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Requested by Adeel · project thread
Builds on #290 (the file tree) and #324 (S3 access keys:
s3.lookup_key,s3.touch), both merged. Checked locally againsts3.py: a real key signs in, its owner's view is listed and read,last_used_atis updated, and revoking the key ends the session.Description
Before: the file tree could be browsed through the API, MCP, S3 and WebDAV, but not mounted as an SMB network drive.
After: Settings → SMB share → Share the file tree over SMB serves it read-only to Finder (
smb://<host>:1445/LENS), Linux (mount -t cifs, or a file manager) and Windows (installed withLENS_SMB_PORT=445, because Explorer only uses 445). People sign in with a file access key (the same keys as S3): the key id is the user name and the secret is the password. Each person sees what the web app shows them. It's off by default, and the SMB server (impacket) is fetched only when the share is turned on.How: the worker runs impacket's SMB server (pure Python, modified Apache 1.1 license), installed as the
smbextra by the components keeper. impacket serves folders throughos; here its module-levelosis a read-only stand-in (domain/smb_share.py,VirtualOS) that answers fromfiletree.Treefor the signed-in key's owner and streams files as they're read. The server is hardened for this use:smb.allowed_networks;Status is at
GET /api/v1/settings/smb/status. The worker container publishes the share on host port 1445 atLENS_SHARE_BIND/LENS_BIND, beside the S3 and WebDAV ports;install.shkeeps aLENS_SMB_PORTgiven on the install line.Motivation and Context
Adeel asked for the graph as a folder and file tree over S3, SMB and NFS, with a separate thread for each. This PR covers SMB. Samba is GPL and would need a FUSE mount, so it uses impacket, which is permissive and runs in-process.
Steps to reproduce (if appropriate):
tests/domain/test_smb_share.pysigns in with impacket's own SMB client. It covers per-person views on the real file tree, read-only enforcement, wrong passwords, guests, revoked keys, allowed networks, and the worker following the settings. I also checked by hand with Samba'ssmbclient(max protocol SMB2 and SMB3): it lists the share, reads a 1 MB file byte-for-byte, and shows the share in-L. put, mkdir and delete are denied, an SMB1-only client is cut off, and an anonymous client is denied.Types of changes
!in the title)Checklist:
make hookschecks it on commit).docs/accordingly (docs/smb.md,docs/file-tree.md).## UnreleasedinCHANGELOG.md.Done questions
GET /settings/smb/status, it's turned on and off withPUT /settings/smb, and the tree itself is in MCP.enabledandallowed_networksare. The host port is set on the install line because Docker publishes ports when containers are created (likeLENS_S3_PORT).share_servicestatus table and no stored-data change.make openapi,uv lock). Backend suite passed locally (950), frontend settings tests and tsc too.🤖 Generated with Claude Code
https://claude.ai/code/session_01VkWr32dEQW7JiHkWwaAwSu