Add outbound AgentLink WSS over the dashboard HTTPS connection #67
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "feat/agent-link-outbound-websocket"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Agent-originated WSS with no target listener, same dashboard HTTPS origin/path and existing API gateway integration. Explicit manual flow: central one-use invitation → agent enrollment → incoming identity/capability review → separate human approval before AgentHub registration. Target and invitation scopes intersect; same target workspace authorization as direct HTTPS. No browser cookies for agent auth; permanent tokens in vaults, hashes only in relay state. TLS verification, no redirects, bounded protocol/concurrency/backpressure/heartbeat, revocation, generation fencing and bounded reconnect with no productive replay. Idle connections do not block host update admission; stop drains entered target work. Pinned ws built into overlay vendor asset with license, no Core import/pin. 10 TLS/protocol/actual-Core tests pass (including NAT/no listener, lost ack/no replay, malformed/oversized frames, dedup/cwd/admission and stop drain). Full backend/API checks and real independent-frontend HTTPS/WSS browser flow also verified locally. No live auto-registration; deleted central namespace remains deleted. Frontend source stays in harness/webui.