vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm-claude-login: refuse a step whose agent name is not an identifier

Browse source 
The minter parses `Request.agent` with `Ident::parse`, as the controller
does, before it makes a scratch directory, runs `claude auth login` or
touches the store, and answers `Failed` otherwise. The name becomes a
directory name and a store path in the one service that writes every
agent's credentials, so it is checked at this service's own boundary.

The doc states that the `operatorsOnly` authelia rule, not the
controller, keeps the routes to operators, and that a stale version record
waits for a relogin. The env-strip comment says it is defence in depth.

Refs #5268
This commit is contained in:
atlas 2026-10-14 23:11:09 +02:00 • committed by mara
commit 693e6e738b
5 changed files with 104 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

2
swarm-claude-login/Cargo.toml
View file

@ -16,6 +16,8 @@ futures-util.workspace = true
hive-log.workspace = true
serde_json.workspace = true
# The login subject and the shapes the controller sends and reads back.
# The agent name a request carries is parsed as the controller parses it.
hive-types.workspace = true
swarm-queue-client.workspace = true
# The credentials and queue client secret paths, and the store login.
swarm-secret-client.workspace = true