vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm-claude-login: refuse a step whose agent name is not an identifier

Browse source 
The minter parses `Request.agent` with `Ident::parse`, as the controller
does, before it makes a scratch directory, runs `claude auth login` or
touches the store, and answers `Failed` otherwise. The name becomes a
directory name and a store path in the one service that writes every
agent's credentials, so it is checked at this service's own boundary.

The doc states that the `operatorsOnly` authelia rule, not the
controller, keeps the routes to operators, and that a stale version record
waits for a relogin. The env-strip comment says it is defence in depth.

Refs #5268
This commit is contained in:
atlas 2026-10-14 23:11:09 +02:00 • committed by mara
commit 693e6e738b
5 changed files with 104 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

1
Cargo.lock generated
View file

@ -4859,6 +4859,7 @@ dependencies = [
"async-nats",
"futures-util",
"hive-log",
"hive-types",
"serde_json",
"swarm-queue-client",
"swarm-secret-client",