4 Commits

Include renames

Author	SHA1	Message	Date
Dark-Alex-17	7cb7d66575	fix: improved handling of non service-specific secrets using sbx custom-secrets	2026-08-17 18:01:21 -06:00
Dark-Alex-17	ecda258d3a	style: Cleaned up some minor styling issues	2026-08-11 13:04:27 -06:00
Dark-Alex-17	3abc30d633	fix(rag): emit an sbx kit v2 mixin and declare RAG credentials to the proxy ... The RAG attach sidecar was written against the sbx kit v1 spec and still emitted schemaVersion "1" with network.allowedDomains, network.serviceDomains, network.serviceAuth, credentials.sources.<n>.env and environment.proxyManaged. Every one of those keys was removed in kit v2. Coyote does not validate mixins, it copies them byte-for-byte into spec.yaml, so the invalid document surfaced only as an opaque sbx failure with no indication of which mixin caused it. generate_rag_sbx_mixin now builds the document from the shared serializer structs instead of a format! string, which is how the envelope drifted unnoticed in the first place. render_mixin_yaml and the RAG sidecar both go through a new render_mixin_document, giving one definition of the envelope and one enforcement point for the rule that every inject domain must also appear in permissions.network.allow. Fix an auth bug the port exposed: inject_rag_secrets bound the API key with sbx secret set, but nothing ever emitted a matching credentials entry, so the proxy held a value with no inject rule and never rewrote the auth header. An attached RAG credential silently did not work inside the sandbox. The sidecar now declares that credential; a RAG with no API key declares none while still receiving egress. Fix the service id: the bind passed the raw file stem instead of routing it through secret_service_id, so a RAG named My_Docs produced an illegal id. The bind and the generated credentials service now share that derivation and cannot disagree. Retire sbx_domain_forms in favour of allow_entry_for_url, now pub(crate). It emitted both a bare host and host:port because v1 serviceDomains needed a bare key; v2 has no such need, so the extra entry is simply wrong. It also defaulted a schemeless host to port 6333 while normalize_base_url resolves it to http and port 80, meaning the allow entry named a port the client never dialled.	2026-08-10 15:58:40 -06:00
Dark-Alex-17	91dbaf5533	feat: upgraded to sbx kit v2 spec for improved integration	2026-08-10 15:26:16 -06:00