mirror of
https://github.com/hanzoai/dev.git
synced 2026-10-25 03:32:32 +00:00
zeekay
a108979757
Adversarial review fixes for the cloud-agent runner: - Path traversal (CONFIRMED): `encode_segment` left `.`/`..` unescaped, so `dev agent run ..` collapsed `/v1/agents/../run` to `/v1/run` via URL normalization, sending the bearer to an unintended endpoint. Reject names client-side against the server grammar (`validate_name`) before building any URL; `encode_segment` stays as defense-in-depth. New `AgentsError::InvalidName`. - Bearer-token exfiltration (CONFIRMED): CODEX_AGENTS_BASE_URL fed the live hanzo.id JWT to any host. Restrict it to HTTPS hanzo.ai/*.hanzo.ai (plus loopback for testing) via `validate_base_url`, mirroring `validate_api_key_remote_host`. Closes userinfo/suffix-spoof bypasses. - Unbounded response body (CONFIRMED): `.text()` had no cap. Read the body in chunks with a 16 MiB ceiling; over-cap responses error instead of OOMing. - --json exit code (CONFIRMED): a recorded error run exited 0 under --json. Now prints the JSON record and still exits non-zero, matching the human-readable path. - 502-masquerade (REFUTED): required `id`/`status`/`model` already prevent arbitrary JSON from decoding into an all-default Run; added a regression test. Tests: agents-client 14/14, cli agent_cmd 3/3. `cargo clippy -D warnings` clean for both crates. /v1 only, no dep changes.