Repository navigation
Show what a linked agent gets, and refuse link downgrades - #51
Open
josephschorr wants to merge 1 commit into
Open
josephschorr wants to merge 1 commit into
josephschorr wants to merge 1 commit into
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub. 1 Skipped Deployment
|
josephschorr
force-pushed
the
feat/desktop-install-links
branch
from
October 30, 2026 23:03
fc5907e to
eefb1a5
Compare
The install-link approval dialog now lists what the agent graph would be granted before the bundle's own name and description: MCP servers, sidecar toolboxes, sandbox tools, network access, credentials, the Secrets the install will ask for, shared cluster resources and bundled agents. Each line is capped, and every entry is flattened like the rest of the bundle text so none can forge a dialog line. A bundle whose contents cannot be read is refused rather than summarized partially. A link whose bundle is an older version of an agent already installed is refused before the dialog: a signed old release is still signed, so a rollback has to go through the file picker or the CLI. The dialog also shows the installed version an upgrade replaces. If the installed version cannot be read, the link is refused.
josephschorr
force-pushed
the
feat/desktop-install-link-review
branch
from
November 5, 2026 16:27
0e545e6 to
972dec7
Compare
josephschorr
force-pushed
the
feat/desktop-install-links
branch
from
November 5, 2026 16:36
eefb1a5 to
a658bb5
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #41, covering two items the security review left open. Stacked on #41; retarget to
mainonce it merges.The approval dialog says what the agent gets. Before the bundle's own name and description, the install-link dialog now lists what the agent and any bundled agents would be granted: MCP servers, sidecar toolboxes, sandbox tools, network access, credentials, the secrets the install will ask for, shared cluster resources, and bundled agents. Long lists are capped. Every entry is flattened like the rest of the bundle text, so none can forge a dialog line. If a bundle's contents can't be read, the link is refused instead of shown with a partial summary.
Links never downgrade. If a link points at an older version of an agent that's already installed, it's refused before the dialog, with a notification explaining how to roll back on purpose (the file picker or the CLI). An old release that's signed is still signed, so the signature check alone didn't prevent this. Upgrades now show which installed version they replace. If the installed version can't be read, the link is refused.