Repository navigation
runtime: exec children lose the runtime credentials, the panel gets its write token - #15
Merged
Merged
Conversation
… its write token Exec children and the agent CLI inherited VEJAS_APPROVAL_TOKEN, VEJAS_TOKEN, VAULT_TOKEN and every VEJAS_SECRET_*. They now get what the manifest declares in ENV. This is hygiene and not a sandbox: an exec connector is trusted code, it runs as the same user and reaches the same bus. It stops an `env` in a log, or an agent reading its environment, from sending the approval token on. With VEJAS_TOKEN set the panel could only approve: every other write got a 401, with no way to give the token, though the audit scope presents the panel as the operator's. It asks once and keeps the token in the page's memory. Smaller: http-in writes its response in one segment, and bench/flow-only.sh and bench/detect.sh stop leaving the runtime and NATS behind, since under set -e the status of the first killed process ended the trap. The release path: scripts/deploy-docs.sh publishes the book from a commit, never from the working tree, and RELEASING.md gains that step, after the book sat on 2026-08-24 through nine releases. It stays manual, since CI would need an SSH key for a box shared with production. A release now pushes master first and tags once CI is green. Backups leave the served directory, where a page carrying a claim corrected a month ago was still reachable. Stale numbers go: 118 MB, 11.2 MB and 10 MB in the comparison and the launch kit, and the count of MCP tools, which depends on what is installed. Co-Authored-By: Claude Opus 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_018wXgxT2UoFSZfqhAE1Tb5V
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What remained open after v0.5.0. This becomes v0.5.1.
sh -cchildren and the agent CLI inheritedVEJAS_APPROVAL_TOKEN,VEJAS_TOKEN,VAULT_TOKENand everyVEJAS_SECRET_*. They now get what the manifest declares inENV. No recipe in the repo reads one by inheritance. Hygiene, not a sandbox: an exec connector is trusted code, runs as the same user and reaches the same bus.VEJAS_TOKENset. Only Approve and Reject worked: every other write got a 401, with no way to give the token. It asks once and keeps it in the page's memory.http-inwrites its response in one segment, and two bench scripts stop leaking the runtime and NATS.scripts/deploy-docs.shpublishes the book from a commit, never the working tree, andRELEASING.mdgains the step: the book sat on 2026-08-24 through nine releases. It stays manual on purpose: CI would need an SSH key for a box shared with production. Master is pushed first and the tag comes once CI is green. Backups leave the served directory.Verified locally: 56 unit tests, 22 golden cases, 50 scripts parse-checked, ten e2e suites including
governed-agent, which now checks the child's environment. In a real browser: a panel write and a replay withVEJAS_TOKENalone, then a replay in governed mode with both tokens.bench/flow-only.shleaves no process behind.🤖 Generated with Claude Code
https://claude.ai/code/session_018wXgxT2UoFSZfqhAE1Tb5V