security: fix beta9 P0 findings (auth fails-open, unauth control API, SSRF, plaintext creds, gateway panic)#4
Merged
Wingie merged 2 commits intoJul 19, 2026
Conversation
… SSRF, plaintext creds, gateway panic) Applies the P0 security hardening from the FlowState audit (wip-specs/beta9/2026-07-13-p0-security-fixes.md). Built against fork HEAD 84ea11c; cross-compiles clean for linux/amd64. 1. Inference API auth was fails-open — AuthMiddleware only populated the auth context, it never rejected anonymous callers, so /chat/completions, /embeddings, /models, /nodes/register, /nodes/:id/heartbeat ran regardless of auth. Node/model management now requires TokenTypeClusterAdmin; chat/embeddings/listing require any authenticated token. 2. SSRF via unvalidated tailscale_ip — handleRegisterNode and MachineKeepalive stored a caller-supplied IP verbatim and used it to build outbound requests. Both now reject anything outside the allowed private range. 3. Unauthenticated agent control API — pkg/agent/control.go endpoints hardened. 4. Plaintext credentials in manifests/k3d/beta9.yaml — removed. 5. Gateway panic path fixed. Files: manifests/k3d/beta9.yaml, pkg/agent/control.go, pkg/api/v1/machine.go, pkg/api/v1/workspace.go, pkg/gateway/inference_handlers.go Co-Authored-By: Claudistrator <savetheplanet@agentosaurus.com>
…via CI gate) The lint_and_test_python_sdk check on PR #4 flagged ruff F401 (unused ChatMessage/EmbeddingResult imports in test_cubic_fixes.py). Rather than just delete the imports, running the suite behind that gate surfaced a real bug: - inference.embed() overloaded the singular `embedding` field with the whole batch list and never populated the plural `embeddings` field, so callers of result.embeddings got an empty list for batch input. test_batch_embeddings was already failing (0 != 3) — hidden because the lint step failed first. Fixes: - embed() now sets `embedding` = first vector (legacy accessor) and `embeddings` = the full batch, per EmbeddingResult's documented field intent. - test_batch_embeddings now asserts the return type (uses EmbeddingResult). - Added test_chat_forwards_chatmessage covering the previously-untested ChatMessage -> dict conversion in chat() (uses ChatMessage). Full SDK suite: 63 passed; ruff clean. Co-Authored-By: Claudistrator <savetheplanet@agentosaurus.com>
Wingie
merged commit Jul 19, 2026
95618d0
into
claude/agentic-rag-browser-use-deps
2 of 3 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Lands the P0 security hardening that was audited + patch-prepared in FlowState (
wip-specs/beta9/2026-07-13-p0-security-fixes.md) but couldn't be pushed from that session (no beta9 push access). Applied on top of the pinned base84ea11c1; cross-compiles clean forlinux/amd64(the deploy target).Fixes (5 P0s)
AuthMiddlewareonly populated the auth context; it never rejected anonymous callers, so/chat/completions,/embeddings,/models,/nodes/register,/nodes/:id/heartbeatserved regardless of auth state. Node/model management now requiresTokenTypeClusterAdmin; chat/embeddings/listing require any authenticated token.tailscale_ip—handleRegisterNode/MachineKeepalivestored a caller-supplied IP verbatim and used it to build outbound chat/embed requests. Both now reject anything outside the allowed private range.pkg/agent/control.go) — hardened.manifests/k3d/beta9.yaml— removed.Files
manifests/k3d/beta9.yaml,pkg/agent/control.go,pkg/api/v1/machine.go,pkg/api/v1/workspace.go,pkg/gateway/inference_handlers.goVerification
GOOS=linux GOARCH=amd64 go build ./...passes. Full unit tests run on Linux (this branch was prepared/verified on darwin, where the gateway/worker CRIU path can't compile — a separate cross-platform item).Follow-ups (tracked separately, not in this PR)
beam-cloud/beta9) sync.pkg/typesfrom the Linux-onlycedanadep).