Repository navigation

fix: Keep the deploy token out of the agent harness container - #4527

Open

maciaszczykm wants to merge 31 commits into

masterfrom

marcin/prod-5297-have-plural-client-in-agent-harness-route-through-mcp-server

Open

fix: Keep the deploy token out of the agent harness container#4527
maciaszczykm wants to merge 31 commits into
masterfrom
marcin/prod-5297-have-plural-client-in-agent-harness-route-through-mcp-server

Commits on Oct 14, 2026
Commits on Oct 15, 2026
- inject the Plural token for agent AI traffic in the MCP server sidecar
  maciaszczykm
  committed
  a3cd497
- fetch agent run credentials with a dedicated query
  maciaszczykm
  committed
  5cdc693
- keep the operator's tool filter on the agent workbench MCP proxy
  maciaszczykm
  committed
  80d85e5
- update docs
  maciaszczykm
  committed
  a7fb7b8
- drop the deploy token from run secrets created before the split
  maciaszczykm
  committed
  54102ca
- remove unused flag
  maciaszczykm
  committed
  f90df02
- stop passing console URL and token through agent configure
  maciaszczykm
  committed
  5429556
- share credential scrubbing across the sidecar token proxies
  maciaszczykm
  committed
  05c3326
- authenticate agent AI traffic with the deploy token
  maciaszczykm
  committed
  6d86505
- simplify agent sidecar proxies
  maciaszczykm
  committed
  1eea23e
- simplify agent sidecar proxy wiring
  maciaszczykm
  committed
  0fc9515
- keep agent deploy token on pre-split pods and the Console AI proxy
  maciaszczykm
  committed
  c771186
- sync agent API reference docs
  maciaszczykm
  committed
  dd0fa64
- authenticate the console ext proxy with the token scheme
  maciaszczykm
  committed
  e331cd2
- fix data race in console ext proxy tests
  maciaszczykm
  committed
  9490140
- keep agent run secrets from colliding across runs
  maciaszczykm
  committed
  71ac1b0
- drop upstream cookies in the openai streaming proxy
  maciaszczykm
  committed
  4e95753
Commits on Oct 16, 2026
Commits on Oct 19, 2026

Navigation Menu

Repository navigation

fix: Keep the deploy token out of the agent harness container - #4527

fix: Keep the deploy token out of the agent harness container#4527
maciaszczykm wants to merge 31 commits into
masterfrom
marcin/prod-5297-have-plural-client-in-agent-harness-route-through-mcp-server

Commits on Oct 14, 2026

route agent harness console calls through the mcp server sidecar

mark console calls from the agent sidecar with client and run headers

add allowlist on the agent sidecar proxy

Commits on Oct 15, 2026

inject the Plural token for agent AI traffic in the MCP server sidecar

fetch agent run credentials with a dedicated query

keep the operator's tool filter on the agent workbench MCP proxy

update docs

drop the deploy token from run secrets created before the split

remove unused flag

stop passing console URL and token through agent configure

share credential scrubbing across the sidecar token proxies

authenticate agent AI traffic with the deploy token

simplify agent sidecar proxies

simplify agent sidecar proxy wiring

keep agent deploy token on pre-split pods and the Console AI proxy

sync agent API reference docs

authenticate the console ext proxy with the token scheme

fix data race in console ext proxy tests

keep agent run secrets from colliding across runs

drop upstream cookies in the openai streaming proxy

Commits on Oct 16, 2026

Merge remote-tracking branch 'origin/master' into marcin/prod-5297-have-plural-client-in-agent-harness-route-through-mcp-server

build tools from go/tools/go.mod and bump x/tools to v0.52.0

update charts

Commits on Oct 19, 2026

restrict the agent sidecar proxies to loopback callers

register the openai streaming proxy only for runs on the Console AI proxy

serve the Console AI proxy for OpenCode runs on the Plural provider

keep the console URL out of the agent container and tidy the sidecar

Merge remote-tracking branch 'origin/master' into marcin/prod-5297-have-plural-client-in-agent-harness-route-through-mcp-server

regenerate files

rename the ext proxy rejection error to satisfy errname

keep function call namespaces in the streaming responses proxy