Module container_credential 

A scoped credential for container agents, in place of the instance auth key.

A container agent is meant to see only its /workspace mount, but the instance key (AGENTMUX_AUTH_KEY) reaches every route srv serves: host shell creation, stream-local-file, editor reads, attachment ingest by path. Its docker exec env therefore carries a token minted here instead, which srv accepts only on container_route_allowed and attributes to the agent it was minted for.

Structs

ContainerGrant

What a container token was minted for.

Registry 🔒

Constants

TOKEN_PREFIX

Prefix that marks a container token in logs and bug reports.

Functions

container_exec_env

A container turn’s docker exec env: the container denylist applied, and the instance key replaced by this block’s container token.

container_route_allowed

The routes a container agent may call. Everything else is refused, notably host shell/pty creation, file streaming, editor and attachment paths, pane and agent opening, UI automation, cron, and the /ws and /agentmux/service RPC surfaces. Matched on the raw path, exactly as the router matches it.

digest 🔒

grant_for

mint 🔒

registry 🔒

revoke_block

Invalidate the block’s token; its container can no longer reach srv.

route_needs_identity

Routes that act on the calling agent’s own data, and so are refused to a container token that carries no agent identity rather than falling back to an agent named in the request body.

token_for_block

The block’s container token: minted on first use, reused on later turns, with the grant’s identity refreshed from this turn’s env.