Authenticate sockets by header or one-time ticket instead of ?token=

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013GAeg4Jo6xjZzjwy9QDWMQ
2026-10-07 08:58:22 +02:00
parent eb45fb2763
commit 5259b8db0a
21 changed files with 336 additions and 44 deletions
@@ -19,6 +19,9 @@ its own wheels without the engine ever installing them. Mint a token from the
 engine with `POST /api/v1/workers/tokens`; it carries this worker's name and
 labels, and `--labels` may repeat those but not change them.

+It sends the token as an `Authorization` header, which an engine from before
+that does not read: upgrade the engine first, then its workers.
+
 A plain `ws://` address is refused unless the engine is on this machine, since
 the token and node secrets would cross the network in clear; `--insecure`
 allows it on a network you trust.