zeekay a108979757 fix(cli): harden dev agent runner — path traversal, token exfil, DoS, exit codes ...

Adversarial review fixes for the cloud-agent runner:

- Path traversal (CONFIRMED): `encode_segment` left `.`/`..` unescaped, so
  `dev agent run ..` collapsed `/v1/agents/../run` to `/v1/run` via URL
  normalization, sending the bearer to an unintended endpoint. Reject names
  client-side against the server grammar (`validate_name`) before building any
  URL; `encode_segment` stays as defense-in-depth. New `AgentsError::InvalidName`.

- Bearer-token exfiltration (CONFIRMED): CODEX_AGENTS_BASE_URL fed the live
  hanzo.id JWT to any host. Restrict it to HTTPS hanzo.ai/*.hanzo.ai (plus
  loopback for testing) via `validate_base_url`, mirroring
  `validate_api_key_remote_host`. Closes userinfo/suffix-spoof bypasses.

- Unbounded response body (CONFIRMED): `.text()` had no cap. Read the body in
  chunks with a 16 MiB ceiling; over-cap responses error instead of OOMing.

- --json exit code (CONFIRMED): a recorded error run exited 0 under --json.
  Now prints the JSON record and still exits non-zero, matching the
  human-readable path.

- 502-masquerade (REFUTED): required `id`/`status`/`model` already prevent
  arbitrary JSON from decoding into an all-default Run; added a regression test.

Tests: agents-client 14/14, cli agent_cmd 3/3. `cargo clippy -D warnings`
clean for both crates. /v1 only, no dep changes.

2026-07-02 00:18:27 -07:00

..

src

fix(cli): harden dev agent runner — path traversal, token exfil, DoS, exit codes

2026-07-02 00:18:27 -07:00

Cargo.toml

feat(cli): run Hanzo Cloud agents from the terminal (dev agent)

2026-07-01 23:59:20 -07:00