3 Commits

Include renames

Author	SHA1	Message	Date
stroblmeandClaude Opus 5.5	cf5329e3a8	Harden the remote worker: TLS off loopback, full digests, filtered env ... fluksio-worker now refuses ws:// and http:// engine and artifact URLs unless they are loopback or --insecure is given; the engine still accepts both. An artifact reference must be sha256: plus 64 hex digits before it is joined into a path, and node code gets the host environment through the engine's credential denylist instead of all of it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013GAeg4Jo6xjZzjwy9QDWMQ	2026-10-06 12:18:30 +02:00
stroblmeandClaude Fable 5	36575c5855	Say the licence on the two pages PyPI will show ... Every other README carries the AGPL line; these two did not, and they are the ones that become pypi.org/project/fluksio and /fluksio-worker — the most public surface the project has, and the place a copyleft licence is least useful to have to go looking for. §13 is named outright for the same reason. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012ue1tkFWB1bcGy3aWhCKpU	2026-08-24 12:51:53 +02:00
stroblmeandClaude Opus 5	2c369ac75f	Split the worker into a distribution of its own ... A cluster or GPU host installs `pip install fluksio-worker` and gets the agent and the runner, not psycopg, numpy and the MCP SDK. The engine depends on it as a workspace member, so the file it launches node code with is the same file a remote worker runs — which is what keeps a node unable to tell the difference. Copying the two files by hand still works. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-21 21:54:10 +02:00