zeekay 5bc4b34731 iam: the credential rides in Authorization, not the query string ...

hanzo-iam's admin calls sent clientId/clientSecret as query parameters.
IAM's app() reads httpx.Basic(c) — the Authorization header and nothing
else (internal/authz/authz.go) — so the pair authenticated nothing and
landed in every access log, proxy log and Referer on the path.

_admin_headers now renders it as HTTP Basic (RFC 6749 2.3.1), a bearer
still wins where one is held, and _admin_params is gone rather than left
returning an empty dict. The async class gets the same one helper.

test_credential_location pins it on both arms: put the pair back in the
query and the test fails on the string it leaks.

2026-08-23 12:23:26 -07:00

..

hanzo

cli: drop 'hanzo install runtime'

2026-08-15 09:07:02 -07:00

hanzo-aci

fix(ci): pin black <26.1 to avoid internal error, lower requires-python to 3.12

2026-03-01 16:01:16 -08:00

hanzo-agent

name the neighbour, so the wrong one is not installed

2026-08-21 16:21:43 +00:00

hanzo-agents

name the neighbour in the docstring too

2026-08-21 16:21:42 +00:00

hanzo-async

feat: auto-install uvloop on Linux/macOS with platform gate

2026-03-09 21:11:54 -07:00

hanzo-cli

pypi: one canonical hanzo, and superseded packages that say where the real one is

2026-08-01 13:35:20 -07:00

hanzo-consensus

fix(ci): pin black <26.1 to avoid internal error, lower requires-python to 3.12

2026-03-01 16:01:16 -08:00

hanzo-dev

legal: hanzo-tools-gimp / hanzo-dev follow the root LICENSE (Apache-2.0)

2026-08-04 01:27:29 -07:00

hanzo-flags

auth: the two key shapes are pk- and sk-, and one sentence says so

2026-08-08 15:04:19 -07:00

hanzo-flow

fix: depend on hanzo-flow (hyphenated PyPI name)

2026-03-25 04:02:13 -07:00

hanzo-hooks

feat: hanzo-dev Python TUI + LSP + hooks + sandbox + vim + git + multi-auth + full parity

2026-04-01 10:41:46 -07:00

hanzo-iam

iam: the credential rides in Authorization, not the query string

2026-08-23 12:23:26 -07:00

hanzo-kms

kms.lux.cloud is the brand host; kms.lux.network is retired

2026-08-05 08:12:55 -07:00

hanzo-lsp

feat: hanzo-dev Python TUI + LSP + hooks + sandbox + vim + git + multi-auth + full parity

2026-04-01 10:41:46 -07:00

hanzo-mcp

the browser transport is the zapd consumer, and only that

2026-08-18 23:13:53 -07:00

hanzo-memory

chore(hanzo-memory): drop orphaned Redis service from compose (#34)

2026-06-16 16:09:23 -07:00

hanzo-network

hanzo-network: carry exo's GPL-3.0 and attribute the fork

2026-08-14 16:55:05 -07:00

hanzo-node

pypi: one canonical hanzo, and superseded packages that say where the real one is

2026-08-01 13:35:20 -07:00

hanzo-research

publish-pypi: read KMS at the route KMS serves

2026-08-14 17:42:58 -07:00

hanzo-s3

refactor(s3): back hanzo-s3 with boto3 over hanzoai/s3, drop minio

2026-06-24 13:50:24 -07:00

hanzo-sandbox

hanzo-sandbox: a client for the sandboxes cloud actually serves

2026-08-09 19:36:57 -07:00

hanzo-tasks

feat(hanzo-tasks): Python SDK for durable task execution

2026-03-19 10:29:31 -07:00

hanzo-tools

auth: the two key shapes are pk- and sk-, and one sentence says so

2026-08-08 15:04:19 -07:00

hanzo-tools-agent

fix: restore 'version = ' prefix in 7 axis pyproject.toml files

2026-05-13 14:23:35 -07:00

hanzo-tools-api

deps: floor hanzo-tools at the version that actually has HanzoCloud

2026-07-27 20:44:05 -07:00

hanzo-tools-auth

auth: verify tokens instead of asserting they exist

2026-07-27 18:55:24 -07:00

hanzo-tools-billing

fix(billing): drop extraneous /api prefix — api.hanzo.ai/v1/billing

2026-07-03 12:31:09 -07:00

hanzo-tools-browser

release(hanzo-tools-browser): 0.5.10 — zapd connect-or-spawn auto-start

2026-07-08 08:50:48 -07:00

hanzo-tools-code

feat(tools): hybrid local+cloud tools -- HanzoCloud client, cloud code/vector actions, vision

2026-07-19 20:02:48 -07:00

hanzo-tools-commerce

fix(ci): resolve root lint failures across workspace packages

2026-03-04 12:15:14 -08:00

hanzo-tools-computer

feat(computer): ydotool/uinput backend (Linux) — avoid xdotool/XTEST crashing Tauri/WebKitGTK

2026-06-17 22:06:55 +00:00

hanzo-tools-config

fix(tools): correct PyPI long_description metadata + stale tool-count tests

2026-06-26 11:57:48 -07:00

hanzo-tools-core

feat(mcp): native MCP ImageContent — tools return images the client can SEE

2026-07-03 00:45:49 -07:00

hanzo-tools-database

fix(ci): pin black <26.1 to avoid internal error, lower requires-python to 3.12

2026-03-01 16:01:16 -08:00

hanzo-tools-editor

fix(ci): pin black <26.1 to avoid internal error, lower requires-python to 3.12

2026-03-01 16:01:16 -08:00

hanzo-tools-fs

feat(mcp): native MCP ImageContent — tools return images the client can SEE

2026-07-03 00:45:49 -07:00

hanzo-tools-gimp

legal: hanzo-tools-gimp / hanzo-dev follow the root LICENSE (Apache-2.0)

2026-08-04 01:27:29 -07:00

hanzo-tools-iam

fix(tools-iam): the MCP IAM tool listed users over a verb being deleted

2026-07-28 15:41:54 -07:00

hanzo-tools-ide

fix(ci): pin black <26.1 to avoid internal error, lower requires-python to 3.12

2026-03-01 16:01:16 -08:00

hanzo-tools-ingress

fix(ci): resolve root lint failures across workspace packages

2026-03-04 12:15:14 -08:00

hanzo-tools-jupyter

fix(ci): pin black <26.1 to avoid internal error, lower requires-python to 3.12

2026-03-01 16:01:16 -08:00

hanzo-tools-kms

kms: migrate hanzo-kms off Infisical paths onto the luxfi/kms surface

2026-07-26 08:29:59 -07:00

hanzo-tools-llm

fix(tools): correct PyPI long_description metadata + stale tool-count tests

2026-06-26 11:57:48 -07:00

hanzo-tools-lsp

auth: the two key shapes are pk- and sk-, and one sentence says so

2026-08-08 15:04:19 -07:00

hanzo-tools-mcp

fix(tools): correct PyPI long_description metadata + stale tool-count tests

2026-06-26 11:57:48 -07:00

hanzo-tools-memory

fix: resolve all ruff lint errors (F401, F841, E741, I001)

2026-03-12 01:12:30 -07:00

hanzo-tools-mpc

fix(ci): resolve root lint failures across workspace packages

2026-03-04 12:15:14 -08:00

hanzo-tools-net

auth: the two key shapes are pk- and sk-, and one sentence says so

2026-08-08 15:04:19 -07:00

hanzo-tools-paas

feat(hanzo-iam): canonical IAM_ env contract + FastAPI integration (1.30.0)

2026-05-14 20:56:32 -07:00

hanzo-tools-plan

fix(tools): correct PyPI long_description metadata + stale tool-count tests

2026-06-26 11:57:48 -07:00

hanzo-tools-reasoning

feat(tools): bidirectional HIP-0300 action sync across Python/TS/Rust

2026-03-10 21:57:50 -07:00

hanzo-tools-refactor

fix(ci): pin black <26.1 to avoid internal error, lower requires-python to 3.12

2026-03-01 16:01:16 -08:00

hanzo-tools-repl

fix(ci): pin black <26.1 to avoid internal error, lower requires-python to 3.12

2026-03-01 16:01:16 -08:00

hanzo-tools-s3

refactor(s3): back hanzo-s3 with boto3 over hanzoai/s3, drop minio

2026-06-24 13:50:24 -07:00

hanzo-tools-shell

a pk- key authenticates nobody, so stop telling readers it reads

2026-08-14 14:45:57 -07:00

hanzo-tools-team

auth: verify tokens instead of asserting they exist

2026-07-27 18:55:24 -07:00

hanzo-tools-test

chore: add README.md for hanzo-tools-code and hanzo-tools-test

2026-03-09 17:49:54 -07:00

hanzo-tools-todo

feat(tools): bidirectional HIP-0300 action sync across Python/TS/Rust

2026-03-10 21:57:50 -07:00

hanzo-tools-ui

auth: the two key shapes are pk- and sk-, and one sentence says so

2026-08-08 15:04:19 -07:00

hanzo-tools-vcs

fix(tools): correct PyPI long_description metadata + stale tool-count tests

2026-06-26 11:57:48 -07:00

hanzo-tools-vector

deps: floor hanzo-tools at the version that actually has HanzoCloud

2026-07-27 20:44:05 -07:00

hanzo-train

feat(hanzo-train): add Tinker-shaped training client (0.1.0)

2026-07-15 18:16:32 -07:00

hanzo-web3

fix(ci): pin black <26.1 to avoid internal error, lower requires-python to 3.12

2026-03-01 16:01:16 -08:00

hanzo-zap

refactor(zap): consume canonical zap-proto, drop hand-rolled wire

2026-06-21 01:29:06 -07:00

hanzoai

Regenerate against the current API document

2026-08-23 10:01:23 -07:00