fix(proxy): normalize trailing-dot CONNECT hosts before policy evaluation#2
Closed
letv1nnn wants to merge 7 commits into
Closed
fix(proxy): normalize trailing-dot CONNECT hosts before policy evaluation#2letv1nnn wants to merge 7 commits into
letv1nnn wants to merge 7 commits into
Conversation
* fix(tui): redraw after sandbox shell exits Closes NVIDIA#2229 Render the restored terminal before synchronous gateway refreshes and propagate terminal lifecycle failures from both SSH handoff paths. Signed-off-by: John T. Myers <9696606+johntmyers@users.noreply.github.com> * fix(tui): restore input after sandbox shell Discard stale events accumulated around the suspended TUI and let the normal periodic tick refresh state after resuming. Signed-off-by: John T. Myers <9696606+johntmyers@users.noreply.github.com> --------- Signed-off-by: John T. Myers <9696606+johntmyers@users.noreply.github.com>
…#2239) Batch triage previously processed all state:triage-needed issues immediately without any confirmation. This led to accidental mass-commenting (29 triage comments on a public repo) when the skill was invoked by mistake. Add a mandatory preview-and-confirm step: the agent must show the issue count and titles, then ask for explicit user confirmation before posting any comments. Single-issue mode is unchanged. Assisted-By: 🤖 Claude Code Signed-off-by: Roland Huß <rhuss@redhat.com>
Signed-off-by: John Myers <johntmyers@users.noreply.github.com> Co-authored-by: John Myers <johntmyers@users.noreply.github.com>
…name (NVIDIA#2241) generate-certs stages temp files beside --output-dir using dir.with_file_name(). When --output-dir is a container or WSL volume mount, the staging dir lands on a different filesystem and std::fs::rename fails with EXDEV. Move staging inside the output dir so the rename always stays on the same filesystem, preserving atomic replacement. Fixes NVIDIA#2173 Signed-off-by: Grace Smith <grasmith@redhat.com>
Signed-off-by: Shiju <shiju@nvidia.com>
* docs(agents): add gator launch skill Signed-off-by: John Myers <johntmyers@users.noreply.github.com> * docs(agents): narrow gator launch trigger Signed-off-by: John Myers <johntmyers@users.noreply.github.com> * docs(agents): trim gator launch skill intro Signed-off-by: John Myers <johntmyers@users.noreply.github.com> * docs(agents): harden gator launch examples Signed-off-by: John Myers <johntmyers@users.noreply.github.com> * docs(agents): avoid assuming gator gateway Signed-off-by: John Myers <johntmyers@users.noreply.github.com> * docs(agents): trim gator launch rules Signed-off-by: John Myers <johntmyers@users.noreply.github.com> --------- Signed-off-by: John Myers <johntmyers@users.noreply.github.com> Co-authored-by: John Myers <johntmyers@users.noreply.github.com>
letv1nnn
force-pushed
the
2201-normalize-trailing-dot-host
branch
from
95a5648 to
9b95e11
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes inconsistent handling of trailing-dot hostnames (e.g. api.example.com.) in the sandbox supervisor's CONNECT proxy. Such hosts are valid RFC 1034 FQDNs used in Kubernetes ndots:5 environments to bypass search-domain expansion, but were treated as distinct from their undotted equivalents across policy evaluation, middleware selection, and credential matching.
Changes
Testing
mise run pre-commitpassesChecklist