bastion agent 0.1.17

2026-10-29 21:42:06 +00:00
parent e3074f50b0
commit 3ae3a2841c
22 changed files with 226 additions and 81 deletions
@@ -54,7 +54,25 @@ text with personal data tokenized (only the rules-pass anchors, unless the
 manifest uses `sterilize`). That is the same trust boundary as the folder
 itself, since the source files are already there, but a sync provider now
 receives a second, flattened, indexable copy. If that matters for a folder,
-exclude `.agent` from sync or keep the output elsewhere (`--out`).
+exclude `.agent` from sync or, for an agent run by hand, keep the output
+outside the folder (`--out`).
+
+Whether a host can reach `.agent/` depends on the bastion's version. From
+bastion 0.58.1 on, the bastion never serves it: a host's listings leave out
+every folder named `.agent`, at any depth and in any letter case, and the
+bastion refuses to stat, read or move anything in one, however the path is
+written and whatever link it goes through, and says why. It knows the folder
+by that name only, so an output folder inside the shared folder under any
+other name (`--out`) is served like any other folder. A bastion older than
+0.58.1 treats `.agent/` like any other folder: a host whose folder grant has
+`read` can list it and read the extract store as it is. On those bastions,
+add `.agent` to the paths the grant excludes; the bastion then leaves it out
+of a host's listings and refuses reads of it.
+
+The bastion keeps its agent in `<root>/.agent/` too, except on
+Windows when the bastion runs as the system service, or when it cannot create
+`.agent` in the folder (a read-only folder, for one); it then keeps it in its
+own state directory.

 The identity key is never in `.agent/`: it is wherever `FREEAGENT_TLS_KEY`
 points. The PII vault (plaintext values) is in `.agent/sanitize/vault.db` for