chore(webhook): bump the pinned local-webhook to 0.8.1 - #162
Merged
Conversation
Moves services.agent-box.webhook.rev from 5d6c9323 (local-webhook 0.8.0) to 8543aff5, the head of local-channels main, which carries 0.8.1. 0.8.1 is a tool-description-only change (defangdevs/local-channels#7, #8): it stops recommending `ttl_hours: 0` for "this box's own repos" and says the opposite — a pinned topic is delivered into whichever session happens to be active, so it interrupts unrelated work indefinitely. Scope the TTL to the work in flight and let it lapse. Same advice now appears on renew_on_event. Until this pin moves, every session on the box reads the old guidance out of the 0.8.0 schema. No behaviour change in the receiver: webhook.py's wire and state contracts are untouched between 0.8.0 and 0.8.1 (the diff is VERSION, one comment block, and four description strings). Checks run: - nix-prefetch-url + `nix hash convert --to sri` for the new sha256, and `builtins.fetchurl` with it resolves and yields VERSION = '0.8.1'. - bin/assemble-module.py re-run; regenerated modules/agent-box.nix is committed and idempotent on a second run. - nix-instantiate --parse modules/agent-box.nix. - module-generated-up-to-date and the webhook VM test are x86_64-only and this box is aarch64, so both are left to CI. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Sxoeoon2SQcbxnaG9tExNY
lionello
approved these changes
Aug 1, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
The box's
services.agent-box.webhook.revpin is still5d6c9323= local-webhook 0.8.0, the Python port merged in #157. Upstream has since shipped 0.8.1 (defangdevs/local-channels#7, #8), and sessions did not pick it up on their own — claude clones the marketplace and tracks its default branch, but the copy the box runs is governed by this pin.This moves the pin to
8543aff5, the head of local-channelsmain.What 0.8.1 changes
Tool descriptions only. It stops recommending
ttl_hours: 0for "this box's own repos" and says the opposite:The same caveat is now attached to
renew_on_event. Pinning may become reasonable once local-channels#1 (deliver into a fresh session rather than the active one) ships.User-visible effect: until this pin moves, every claude session on the box reads the old advice out of the 0.8.0 tool schema and can be talked into pinning a subscription that then hijacks unrelated sessions.
Security effect: none. HMAC verification, the 401-on-bad-signature path fail2ban keys on, the socket, and the public route are untouched.
No receiver behaviour change
The 0.8.0 → 0.8.1 diff to
webhook.pyisVERSION, one comment block, and four description strings. Wire and state contracts (sources.json,filter.<session>.json, the IPC envelope, TTL/warm-renew semantics) are identical.webhook.pyis byte-identical across7aa0c583,05d14f1aand8543aff5(blob3493d06), so pinning the branch head rather than the version-bump commit fetches the same file.Checks run
nix-prefetch-url+nix hash convert --hash-algo sha256 --to srifor the new hash;builtins.fetchurlwith it resolves, and the fetched file hasVERSION = '0.8.1'and zero occurrences of the old "this box's own repos" guidance.bin/assemble-module.pyre-run; the regeneratedmodules/agent-box.nixis committed and a second run is a no-op (no drift).nix-instantiate --parse modules/agent-box.nix.module-generated-up-to-dateand the webhook VM test are defined forx86_64-linuxonly and the box I ran on isaarch64-linux, so both are left to CI — I could not execute them locally.Cost / IAM / networking / migration
None. Deployed boxes pick up the new
webhook.pyon the next rebuild; the unit restarts, in-flight deliveries are not persisted either way.🤖 Generated with Claude Code
https://claude.ai/code/session_01Sxoeoon2SQcbxnaG9tExNY