hermes-admin/hermes-agent
1
0
Fork 0
Code Issues Pull Requests Actions 28 Packages Projects Releases Wiki Activity

fix(auth): apply newer hosted bootstrap session (#64612)

Browse Source 
* fix(auth): apply newer hosted bootstrap session

* fix(auth): validate rebootstrap replacement seeds
This commit is contained in:
Ben Barclay
2026-07-16 08:52:47 +10:00
committed by GitHub
parent 5fc2d9e64d
commit 3f2a389c7e
3 changed files with 264 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
docker/stage2-hook.sh
View File

@@ -452,11 +452,12 @@ fi
# the credential is replaced. An orchestrator that manages the container can
# supply a freshly-issued session via HERMES_AUTH_JSON_REBOOTSTRAP (distinct
# from the create-only *_BOOTSTRAP var); this helper swaps ONLY the
# providers.nous entry, and ONLY when the on-disk entry is provably terminal.
# Every other case (healthy, rotating, absent, or unparseable auth.json) is a
# no-op, so it is safe to leave the env set across restarts and never risks
# clobbering a good/rotated token. Runs as its own stdlib-only subprocess (no
# app imports) and always exits 0.
# providers.nous entry when the on-disk entry is provably terminal OR the
# orchestrator seed has a later obtained_at timestamp. The latter covers the
# stop/update/start sequence where NAS already revoked the still-healthy-looking
# local session. Older/incomparable seeds remain no-ops, so leaving the env set
# cannot roll a healthy rotated token backward. Runs as its own stdlib-only
# subprocess (no app imports) and always exits 0.
if [ -f "$HERMES_HOME/auth.json" ] && [ -n "${HERMES_AUTH_JSON_REBOOTSTRAP:-}" ]; then
if refuse_symlinked_path "reseed" "$HERMES_HOME/auth.json"; then
: