@whalent/agent 0.3.437 → 0.3.439

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/README.md +17 -0
  2. package/dist/core.cjs +7 -7
  3. package/dist/index.cjs +1 -1
  4. package/package.json +2 -2
package/README.md CHANGED
@@ -241,3 +241,20 @@ Backend unavailability falls back to the independent static manifest at the stat
241
241
  Cloud machines configured with `WHALENT_VNC=0` do not auto-register the built-in
242
242
  `desktop-browser` MCP, even when its launcher exists in the shared image.
243
243
  Desktop-enabled cloud machines retain automatic registration and explicit MCP overrides.
244
+
245
+ ### Outbound request identity
246
+
247
+ Agent-originated HTTP and WebSocket handshakes use
248
+ `User-Agent: whalent-agent/<runtime-version> (<feature>)`, plus
249
+ `X-Whalent-Agent-Version` and `X-Whalent-Agent-Feature`. This includes CDN route
250
+ lists, DNS/health probes, server-directed `network.probe`, Gateway control,
251
+ updates/downloads, remote-access/preview edge connections, and Agent-generated
252
+ HTTP MCP configuration. Feature names are fixed public identifiers; they never
253
+ contain a token, user ID, machine name or private path. Existing empty, library
254
+ and legacy User-Agents are replaced at the transport boundary.
255
+
256
+ Use `createFeatureFetch('feature.name')` for new HTTP consumers and
257
+ `agentHttpHeaders(..., version, 'feature.name')` for independent transports.
258
+ The request-identity coverage test rejects unlabelled transport calls. Transparent
259
+ preview forwarding retains the original browser request headers; third-party
260
+ provider executables and user commands own their own network identity.