security patching - #8
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
• H1 — guest network + ungated run_command. Stopped TSI inet (krun_add_vsock(id, 0)). Moved MCP HTTPS to a host broker. Guest no longer has an MCP/egress client. run_command requires a host allow/deny; TUI prompts, otherwise it is denied.
• M2 — dirty snapshots copying secrets. Ephemeral copies now use git ls-files --exclude-standard, so gitignored files stay on the host.
• M3 — HTTP base_url. Model base_url must be https, same rule as MCP URLs.
• M4 — MCP token on redirects. Host MCP client pins the configured origin and refuses cross-host redirects so the bearer is not replayed.
• M6 — MCP tokens in the guest. Tokens stay on the host and are resolved per call. The guest rejects config that still contains secrets or MCP URLs.
• M7 — any model alias. provider_open only accepts the session’s selected model.
Also in that work
• Protocol bumped to 4 (LLM broker + MCP broker + command approval). Old guests are refused until make image-update.
• abox exec has no approver, so run_command is fail-closed there.
What we did after that
• Fixed the compile break: provider.go used protocol.UsageInfo with no protocol import.
• Re-ran the full unit-test set (all packages with tests passed).
• Rebuilt host, VMM, guest, and the golden image so you can test locally on a new session.