Repository navigation

feat(hub): make a remote caucus hub work, and shut the doors it left open - #101

Merged

obeone merged 36 commits into

mainfrom

feat/remote-hub

Sep 18, 2026

Commits on Sep 18, 2026

feat(hub): guard the agent door with a shared agent key
obeone
committed
0812797
feat(clients): send CAUCUS_AGENT_KEY on register
obeone
committed
c0bd65b
feat(plugin): forward the agent key to a keyed hub
obeone
committed
1733c8c
test(hub): cover the shared agent key end to end
obeone
committed
8b6402b
docs(changelog): record the shared agent key
obeone
committed
7ae334d
feat(urlguard): validate the hub public base URL
obeone
committed
649e5bf
feat(mcp-http): hand a remote agent a runnable watch command
obeone
committed
38320ab
feat(hub): make a hub reachable from other machines
obeone
committed
fef3335
feat(setup-service): require the agent key on a non-loopback bind
obeone
committed
3fbd9ad
test: cover the remote-hub flags, watch command and bind refusal
obeone
committed
148db11
docs(changelog): record the remote-hub flags and the bind refusal
obeone
committed
dac307c
docs: add the remote-hub guide and fix the stale /ui auth claim
obeone
committed
5235924
refactor(urlguard): centralise the loopback definition
obeone
committed
94637ee
fix(clients): present the agent key on the pre-join read calls
obeone
committed
34e636c
fix(mcp-http): emit a remote watch command the watcher will accept
obeone
committed
a1367ae
fix(hub): close the read surface the agent key claimed to guard
obeone
committed
13a2e0a
fix(hub): require a public URL on a wildcard bind
obeone
committed
255ad30
feat(setup-service): install a hub that can actually serve remotely
obeone
committed
7a3053c
docs(changelog): record remote-hub review fixes under Unreleased
obeone
committed
d12a49b
feat(state): mint and redeem single-use watch tickets
obeone
committed
1016736
feat(hub): add POST /watch-ticket/redeem and gate /ping on the agent key
obeone
committed
6838991
feat(watch): accept a single-use ticket in place of a raw token
obeone
committed
fe6eb73
fix(mcp-http): hand a remote agent a ticket, not its peer token
obeone
committed
af7c924
test: cover watch tickets, the ticket-only watch_command, and the gated /ping
obeone
committed
08edc80
docs: cover watch tickets, gated read endpoints, and the agent-key threat model
obeone
committed
9888f8b
fix(watch-ticket): revoke a member's ticket on refresh, leave, and sweep
obeone
committed
7ec7ba5
docs(watch-ticket): correct resurrection and argv-exposure claims
obeone
committed
14015c0
docs(changelog): watch_command keeps at most one live ticket per member
obeone
committed
5ccd144
fix(hub): arm the credentials guard on a non-loopback public URL
obeone
committed
01f424e
fix(setup-service): refuse a loopback bind advertised off-box
obeone
committed
82b1392
test: cover the credentials guard on an advertised loopback hub
obeone
committed
eff9f92
docs(remote-hub): correct the reverse-proxy section on credentials
obeone
committed
462a424
docs(changelog): record the public-url credentials guard under Unreleased
obeone
committed
26ae438
test(watch-ticket): drive the reaped-peer revival test off one clock
obeone
committed
4d75bfc
Merge remote-tracking branch 'origin/fix/public-url-credentials-guard' into feat/remote-hub
obeone
committed
225724c
Merge branch 'main' into feat/remote-hub
obeone
committed
ebc71ed