feat(egress): re-land iron-proxy credential-injection firewall (revert of #58489) - #70848
Merged
Conversation
This reverts commit c6dc7c0.
…aware 3-field probe test_docker_network_config.py landed on main after the #58489 revert and stubbed docker ps with the 2-field ID\tState format. The re-landed egress-aware reuse probe requests ID\tState\tEgressLabel when egress is off, so the fake line failed to parse and the reuse path never fired. Fixture-only change; production behavior is unchanged.
Contributor
૮ >ﻌ< ა ci reviewran on 9bbaf40 all good! |
This was referenced Jul 24, 2026
alt-glitch
added
type/feature
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Re-lands PR #30179
The feature: real API keys never enter the Docker sandbox. Containers receive per-provider stand-in proxy tokens under the standard env names; the managed iron-proxy daemon (MITM at the network boundary) swaps them for real credentials on the way out. Tokens lifted from a compromised sandbox are useless anywhere else. Disabled by default;
hermes egress setup→hermes egress start.Changes
8790adc4c(29 files, +8,363), restoringagent/proxy_sources/iron_proxy.py,hermes_cli/proxy_cli.py(hermes egressinstall/setup/start/stop/restart/reload/status/disable/config), Docker backend egress wiring,/egressstatus slash surface, dashboard schema entries, docs (user-guide/egress/,developer-guide/egress-internals.md), and the three test suites.tools/environments/docker.py: kept the new_container_network_modereuse guard from #3167dbaee2 AND the egress-aware_find_reusable_container(task, profile, egress_label)signature — both guards now compose on the reuse path.hermes_cli/commands.py:_SLACK_VIA_HERMES_ONLYupdated for the /topup rehaul (topup, moa, debug, egress— stalecredits/billingentries dropped).tests/hermes_cli/test_web_server.py: kept both sides' new tests (memory-provider schema tests from main + proxy schema lifecycle test).Validation
tests/test_iron_proxy{,_cli,_e2e}.pytests/tools/test_docker_environment.py+ web_server/commands/status/unknown_commandhermes egress --helpagainst temp HERMES_HOME_egress_proxy_args_for_docker()proxy.enabled: true+ daemon down +enforce_on_dockerhermes egress setupInfographic