Repository navigation

fix: renew workspace callback tokens for sessions awake past 24h - #2224

Merged

simple-agent-manager[bot] merged 19 commits into

mainfrom

sam/fix-secure-renewal-workspace-qfahde

Oct 4, 2026

Commits on Oct 4, 2026

task: add workspace callback token renewal

raphaeltm
and
claude
committed
977e8b4
feat(api): renew workspace callback tokens with dual node+workspace proof

raphaeltm
and
claude
committed
ef688ad
fix(api): deliver workspace tokens to VM nodes only and re-check incarnation

raphaeltm
and
claude
committed
4a90f5b
feat(vm-agent): renew workspace callback tokens and propagate every change

raphaeltm
and
claude
committed
aec1391
test(vm-agent): cover workspace token renewal, delivery and held messages

raphaeltm
and
claude
committed
d3f976a
docs: callback token scopes, lifetime and workspace renewal

raphaeltm
and
claude
committed
1fcfaa4
task: record final renewal design decisions

raphaeltm
and
claude
committed
3e870b5
refactor(api): keep the hibernate token delivery free of route helpers

raphaeltm
and
claude
committed
7b33d4b
style(api): sort route helper exports

raphaeltm
and
claude
committed
b80a779
fix(api): rate-limit workspace token renewal and keep it VM-only

raphaeltm
and
claude
committed
8bf5fe7
fix(vm-agent): lock workspace token reads and follow renewals everywhere

raphaeltm
and
claude
committed
c19872f
refactor(vm-agent): move the publish job reporter out of mcp_build.go

raphaeltm
and
claude
committed
514647b
fix(api): share the hibernate token through a plain memo object

raphaeltm
and
claude
committed
a04a7a1
task: record review outcomes, evidence and follow-ups for token renewal

raphaeltm
and
claude
committed
da5c168
refactor(vm-agent): move PTY and container-resolver helpers out of workspace_routing.go

raphaeltm
and
claude
committed
22e06a4
task: archive workspace callback token renewal

raphaeltm
and
claude
committed
74b81b0
fix(vm-agent): decode callback token claims instead of skipping verification

raphaeltm
and
claude
committed
4297bfe
fix(api): mark every renewal response no-store, including errors

raphaeltm
and
claude
committed
ee64290
fix(api): renumber the renewal rate-limit migration to 0180

raphaeltm
and
claude
committed
ef6e796

Navigation Menu

Repository navigation

fix: renew workspace callback tokens for sessions awake past 24h - #2224

fix: renew workspace callback tokens for sessions awake past 24h#2224
simple-agent-manager[bot] merged 19 commits into
mainfrom
sam/fix-secure-renewal-workspace-qfahde

Commits on Oct 4, 2026

task: add workspace callback token renewal

feat(api): renew workspace callback tokens with dual node+workspace proof

fix(api): deliver workspace tokens to VM nodes only and re-check incarnation

feat(vm-agent): renew workspace callback tokens and propagate every change

test(vm-agent): cover workspace token renewal, delivery and held messages

docs: callback token scopes, lifetime and workspace renewal

task: record final renewal design decisions

refactor(api): keep the hibernate token delivery free of route helpers

style(api): sort route helper exports

fix(api): rate-limit workspace token renewal and keep it VM-only

fix(vm-agent): lock workspace token reads and follow renewals everywhere

refactor(vm-agent): move the publish job reporter out of mcp_build.go

fix(api): share the hibernate token through a plain memo object

task: record review outcomes, evidence and follow-ups for token renewal

refactor(vm-agent): move PTY and container-resolver helpers out of workspace_routing.go

task: archive workspace callback token renewal

fix(vm-agent): decode callback token claims instead of skipping verification

fix(api): mark every renewal response no-store, including errors

fix(api): renumber the renewal rate-limit migration to 0180