pulse

mirror of https://github.com/rcourtman/Pulse.git synced 2026-09-10 10:35:51 +00:00

Files

T

rcourtman 61c8e8ca00 Make agent command-exec token rejection actionable, not a silent 'Invalid token'

An agent enrolled for metrics but whose token the server doesn't recognise (or
that lacks the agent:exec scope, or is bound to a different agent) was rejected
on the command-exec WebSocket with a bare 'Invalid token' and — for the
token-not-found case — no server log at all. The agent then retried forever,
logging only 'Invalid token', so the operator had no signal that discovery
deep-scan was failing or why. (Confirmed live: delly/minipc agents pointed at a
backend that didn't recognise their token retried thousands of times; discovery
abstained for every guest as a result.)

- agentexec/server.go: the registration-rejection message the agent logs
  verbatim now says 'agent token not authorized for command execution — re-run
  the agent installer to enroll an agent:exec-scoped token'.
- api/agent_exec_token_binding.go: the previously-silent token-not-recognised
  branch now logs the specific reason with the agent hostname.

Contract-neutral: same rejection behaviour, just legible. Regression test:
TestHandleWebSocket_RejectionMessageIsActionable. Verified live end-to-end.

2026-06-09 17:55:09 +01:00

approval_grant_test.go

Tighten unified agent hardening proof

2026-04-23 23:37:25 +01:00

approval_grant.go

Tighten unified agent hardening proof

2026-04-23 23:37:25 +01:00

deploy_test.go

Harden agentexec token binding and disk filtering

2026-04-23 15:54:48 +01:00

export_test_helpers.go

feat: Pulse v6 release