You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I started down the path to isolating agents with a VM but realized you can't get very far due to Hapi's auth model.
No matter how much I isolate the VMs, the Hapi runners all need the same token and port that I personally use, so they can all talk to each other (and to the hub as me), and we can't effectively isolate them. I've seen there's discussion about A2A and the ping tools being scoped down (the A2A RFC is #1332; ping-scoping in #1401 and #1402), but this seems deeper than that. Beyond the peer messaging, every runner holds the same owner-level credential, so you can't effectively isolate them.
As an example: if I have one runner in a VM with email access, and a runner in another VM processing untrusted text, nothing stops the latter from commanding the former.
One way to solve this would be scoped tokens, where a token lets a runner report back to the hub but not command it or interact with other agents. And along the lines of the A2A discussion, a shared scoped token could act as a shared space, so runners that should collaborate share one while everything else stays isolated.
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
Uh oh!
There was an error while loading. Please reload this page.
Huge fan of Hapi, new to the discussion.
I started down the path to isolating agents with a VM but realized you can't get very far due to Hapi's auth model.
No matter how much I isolate the VMs, the Hapi runners all need the same token and port that I personally use, so they can all talk to each other (and to the hub as me), and we can't effectively isolate them. I've seen there's discussion about A2A and the ping tools being scoped down (the A2A RFC is #1332; ping-scoping in #1401 and #1402), but this seems deeper than that. Beyond the peer messaging, every runner holds the same owner-level credential, so you can't effectively isolate them.
As an example: if I have one runner in a VM with email access, and a runner in another VM processing untrusted text, nothing stops the latter from commanding the former.
One way to solve this would be scoped tokens, where a token lets a runner report back to the hub but not command it or interact with other agents. And along the lines of the A2A discussion, a shared scoped token could act as a shared space, so runners that should collaborate share one while everything else stays isolated.
All reactions