Bremen
/
emma-hermes
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

docs(auth): scrub Fly.io host detail from quarantine-log comment (#60145) 

hermes-agent is public/OSS; the forensic-logging comment in
_quarantine_nous_oauth_state named 'Fly' (the specific managed-hosting compute
provider) twice. Reword generically ('a hosted agent', 'a managed log drain may
be WARNING-only') — the behaviour is unchanged, only the comment. Follows the
same scrub applied to the boot re-seed helper (#59983) before merge; this one
slipped through in #59976.
fix/verification-admin-route-recovery
Ben Barclay 2026-07-16 08:44:43 +10:00 committed by GitHub
parent 0c1adb4877
commit 5fc2d9e64d
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
hermes_cli/auth.py
View File

@ -4923,11 +4923,11 @@ def _quarantine_nous_oauth_state(
reason: str, reason: str,
) -> None: ) -> None:
"""Keep routing metadata but remove dead OAuth material so it is not replayed.""" """Keep routing metadata but remove dead OAuth material so it is not replayed."""
# Forensic logging BEFORE we clear the token material. A NAS-hosted Fly agent # Forensic logging BEFORE we clear the token material. A hosted agent
# can take a terminal invalid_grant and get quarantined here silently: the # can take a terminal invalid_grant and get quarantined here silently: the
# only downstream signal is a "No access token found" WARNING once the pool # only downstream signal is a "No access token found" WARNING once the pool
# is already empty, which is too late to root-cause. The Fly log drain is # is already empty, which is too late to root-cause. A managed log drain may
# WARNING-only, so this MUST be logger.warning (INFO never reaches the drain). # be WARNING-only, so this MUST be logger.warning (INFO never reaches it).
# #
# Redaction safety: emit ONLY the 12-char SHA-256 hex prefix of the refresh # Redaction safety: emit ONLY the 12-char SHA-256 hex prefix of the refresh
# token (correlates to NAS's refreshTokenHash without leaking the secret) plus # token (correlates to NAS's refreshTokenHash without leaking the secret) plus