@sjawhar/claude-envoy 1.19.0 → 1.20.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/.omp-plugin/plugin.json
CHANGED
package/dist/envoy-channel.js
CHANGED
|
@@ -55262,7 +55262,7 @@ var import_nats2 = __toESM(require_mod4(), 1);
|
|
|
55262
55262
|
|
|
55263
55263
|
// package.json
|
|
55264
55264
|
var name = "@sjawhar/claude-envoy";
|
|
55265
|
-
var version2 = "1.
|
|
55265
|
+
var version2 = "1.20.0";
|
|
55266
55266
|
var legion = {
|
|
55267
55267
|
daemonApiVersion: 56
|
|
55268
55268
|
};
|
package/package.json
CHANGED
|
@@ -15,12 +15,17 @@ Your session never holds the value, and nothing of it reaches your transcript.
|
|
|
15
15
|
agent-secrets NAME... [--reason TEXT] [--wait DURATION] [--ttl DURATION] -- <command> [args...]
|
|
16
16
|
```
|
|
17
17
|
|
|
18
|
-
- Each granted secret reaches `<command>`'s environment under its own name
|
|
18
|
+
- Each granted secret reaches `<command>`'s environment under its own name, as the value or, for
|
|
19
|
+
a secret behind the airlock, as a placeholder standing for it (below). Nothing runs unless
|
|
19
20
|
every name is granted: a denial of one name denies the whole request, so the command never starts
|
|
20
21
|
with some of its secrets missing (`cmdExec`, `packages/envoy/cmd/agent-secrets/main.go`).
|
|
21
22
|
- `--reason` is what a person reads if the request waits for a decision. Write one.
|
|
22
23
|
- `agent-secrets --help` holds the rest: the flags that narrow a GitHub App token
|
|
23
24
|
(`--github-owner`, `--github-repo`, `--github-read-only`), and how long a grant lasts.
|
|
25
|
+
- A narrowing and the airlock do not go together. Ask for a narrowing in a run whose grant holds
|
|
26
|
+
a secret behind the airlock (below) and the broker refuses the release, naming that secret;
|
|
27
|
+
nothing runs. Ask for the GitHub App secret in a run of its own, with no airlocked name beside
|
|
28
|
+
it.
|
|
24
29
|
|
|
25
30
|
## The command reads the value, your shell does not
|
|
26
31
|
|
|
@@ -34,8 +39,9 @@ agent-secrets LEGION_SLACK_BOT_TOKEN -- \
|
|
|
34
39
|
|
|
35
40
|
Your own shell expands `$LEGION_SLACK_BOT_TOKEN` before `agent-secrets` runs, and in your shell that
|
|
36
41
|
name is empty. Measured on 2026-11-04 from a Legion issue pod: Slack answered
|
|
37
|
-
`{"ok":false,"error":"not_authed"}`.
|
|
38
|
-
|
|
42
|
+
`{"ok":false,"error":"not_authed"}`. What the client hands over — the value, or the placeholder of
|
|
43
|
+
a secret behind the airlock — exists only in the environment of the command the client starts, so
|
|
44
|
+
that command must read it itself. Put the command in single quotes, inside
|
|
39
45
|
`sh -c`, where the quotes keep the expansion for the child:
|
|
40
46
|
|
|
41
47
|
```sh
|
|
@@ -50,13 +56,58 @@ The repository uses the same form for a GitHub App token in `docs/deployment.md`
|
|
|
50
56
|
agent-secrets LEGION_IMPLEMENT_APP --reason=… -- sh -c 'printf %s "$LEGION_IMPLEMENT_APP"'
|
|
51
57
|
```
|
|
52
58
|
|
|
59
|
+
## A secret behind the airlock
|
|
60
|
+
|
|
61
|
+
Your deployment can hold a secret's value back and give your command a stand-in. You see it in the
|
|
62
|
+
command's environment: the name holds `agent-secrets-placeholder-` and 32 letters and digits, not
|
|
63
|
+
the value. A length or a prefix probe there reads the placeholder, and proves nothing about the
|
|
64
|
+
real value.
|
|
65
|
+
|
|
66
|
+
A call to that secret's service goes through the broker's own proxy, which `agent-secrets` names
|
|
67
|
+
in the run's environment (`HTTPS_PROXY`, a `NO_PROXY` that keeps the secret's hosts on that proxy,
|
|
68
|
+
and a trust bundle). The proxy swaps the placeholder for the real value in the headers the
|
|
69
|
+
secret's rule names. Three things follow for the command you write:
|
|
70
|
+
|
|
71
|
+
- Make every call inside the `agent-secrets NAME -- command` run, with the environment that run
|
|
72
|
+
gives it. A tool that keeps a token in a cache file across runs, or that makes its calls outside
|
|
73
|
+
the run, stops working. Ask for the grant in the run that spends it.
|
|
74
|
+
|
|
75
|
+
- Pass no value you obtained some other way. The proxy refuses a request whose headers already
|
|
76
|
+
carry the real value.
|
|
77
|
+
|
|
78
|
+
- The placeholder is that one grant's, and works only while the grant lives.
|
|
79
|
+
|
|
80
|
+
A refusal comes from the proxy, not from the service:
|
|
81
|
+
|
|
82
|
+
- An HTTP error naming the rule that refused it: a TLS name or `Host` that is not the host the
|
|
83
|
+
command asked for, a method or a path outside the entry's `allow`, a path with a `.` or `..`
|
|
84
|
+
segment, an `X-HTTP-Method-Override`, `X-HTTP-Method` or `X-Method-Override` header where the
|
|
85
|
+
entry lists methods, plain `http://` to a host an entry binds, or a private address.
|
|
86
|
+
|
|
87
|
+
- `407` once the grant ends, on every call to any host. A WebSocket open at that moment is
|
|
88
|
+
closed with the grant. A tunnel to a host no entry binds carries no value, so it runs to its
|
|
89
|
+
idle limit instead.
|
|
90
|
+
|
|
91
|
+
- `503` when the broker could not read the grant at all. The grant has not ended and the call
|
|
92
|
+
can be made again.
|
|
93
|
+
|
|
94
|
+
A retry fixes neither of the first two, and neither does another name. A `407` needs a new
|
|
95
|
+
grant. A rule's refusal needs a change to the rules file in the deployment's own repository,
|
|
96
|
+
which a person reviews. Report the refusal as you report a service out of reach: the command you
|
|
97
|
+
ran and the output you saw.
|
|
98
|
+
|
|
99
|
+
Two calls are not refused by the proxy. A call to a host no entry binds goes out unread, and a
|
|
100
|
+
placeholder in a header the entry does not name goes out as it is, so the service refuses the
|
|
101
|
+
placeholder and its own error is what you see.
|
|
102
|
+
|
|
53
103
|
## The value never reaches your transcript
|
|
54
104
|
|
|
55
105
|
Your transcript keeps everything a command prints.
|
|
56
106
|
|
|
57
107
|
- Never echo or print the value, and never run `curl -v`, `curl --trace` or a shell with `set -x`
|
|
58
108
|
around it: each of those writes the header, and so the value, to your output.
|
|
59
|
-
- Check a value's shape by its length and its prefix alone
|
|
109
|
+
- Check a value's shape by its length and its prefix alone. For a secret behind the airlock, that
|
|
110
|
+
reads the placeholder's shape and not the value's:
|
|
60
111
|
|
|
61
112
|
```sh
|
|
62
113
|
agent-secrets NAME -- sh -c 'echo "${#NAME}"; case "$NAME" in ghp_*) echo prefix-ok;; *) echo prefix-no;; esac'
|