mirrors/hermes-agent
1
0
Fork 0
mirror of https://github.com/NousResearch/hermes-agent.git synced 2026-07-22 16:25:58 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 5

docs(auth): scrub Fly.io host detail from quarantine-log comment (#60145)

Browse source 
hermes-agent is public/OSS; the forensic-logging comment in
_quarantine_nous_oauth_state named 'Fly' (the specific managed-hosting compute
provider) twice. Reword generically ('a hosted agent', 'a managed log drain may
be WARNING-only') — the behaviour is unchanged, only the comment. Follows the
same scrub applied to the boot re-seed helper (#59983) before merge; this one
slipped through in #59976.
This commit is contained in:
Ben Barclay 2026-07-16 08:44:43 +10:00 • committed by GitHub
parent 0c1adb4877
commit 5fc2d9e64d
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 3 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

6
hermes_cli/auth.py
View file

@ -4923,11 +4923,11 @@ def _quarantine_nous_oauth_state(
reason: str,
) -> None:
"""Keep routing metadata but remove dead OAuth material so it is not replayed."""
# Forensic logging BEFORE we clear the token material. A NAS-hosted Fly agent
# Forensic logging BEFORE we clear the token material. A hosted agent
# can take a terminal invalid_grant and get quarantined here silently: the
# only downstream signal is a "No access token found" WARNING once the pool
# is already empty, which is too late to root-cause. The Fly log drain is
# WARNING-only, so this MUST be logger.warning (INFO never reaches the drain).
# is already empty, which is too late to root-cause. A managed log drain may
# be WARNING-only, so this MUST be logger.warning (INFO never reaches it).
#
# Redaction safety: emit ONLY the 12-char SHA-256 hex prefix of the refresh
# token (correlates to NAS's refreshTokenHash without leaking the secret) plus