Repository navigation
improvement(agent-vault): mint sessions with accessBundle - #481
saifsmailbox98 merged 2 commits into
Conversation
|
💬 Discussion in Slack: #pr-review-cli-481-improvement-agent-vault-mint-sessions-with-accessbundle Posted by Review Police — reviews, comments, new commits, and CI failures will stream into this channel. |
 [Medium impact] The PR appears safe to merge after the stated Cloud deployment requirement is met.
|
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Beyond the inline finding, I also checked accessBundles[0] in agent_vault_run.go for an empty-slice panic and for silently dropped bundles. It's safe on both counts: the mint only runs inside if len(accessBundles) > 0, and an earlier len(accessBundles) > 1 check already rejects more than one bundle.
Extended reasoning...
The change switches the session-mint request from an accessBundles list to a single accessBundle string and sends only the first element. The guards at lines 258 and 373 of packages/cmd/agent_vault_run.go rule out the out-of-range index and any silent loss of extra bundles.
…session-use-one-access-bundle-instead-of-a-list # Conflicts: # packages/api/agent_vault.go # packages/cmd/agent_vault_run.go
Description 📣
agent-vault run --access-bundlenow mints withaccessBundle: "<name>"instead ofaccessBundles: ["<name>"], matching the session API change in Infisical/infisical#9099. The flag, the env var and the "pass it once" check are unchanged.Merge after Infisical/infisical#9099 is deployed to Cloud: a server without it rejects
accessBundlewith a 422. Servers with it still accept the old list, so older CLIs keep working.Related: Infisical/python-sdk-official#67, Infisical/agent-reference-architectures#4
AGE2-282
Type ✨
Tests 🛠️
# Here's some code block to paste some code snippets