Skip to content

Granting an agent a key asks you to confirm

Choose a tag to compare

View all tags
@github-actions github-actions released this 26 Aug 12:47
· 10 commits to main since this release
v1.21.0
1a0a3df
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

New

  • Approving a credential request now asks for your fingerprint, and the prompt says who is asking. When an agent requests one of your keys, approving it raises your system's confirmation prompt naming the agent and the credential: "Hypergate" is trying to grant Claude Code access to the credential "GITHUB_TOKEN". Handing a key to an agent is the one grant you make on something else's behalf, so it is worth a moment of proof that a person is actually at the keyboard.

    If your machine cannot ask, because it has no fingerprint reader or equivalent, approving still works exactly as it did before and Hypergate tells you it could not ask rather than pretending you confirmed. Refusing the prompt grants nothing and leaves the request waiting, so you can simply try again.

Improvements

  • The confirmation prompts say what they are actually about. Revealing a value now reads reveal the value of "GITHUB_TOKEN" rather than a bare name.

Bug fixes

  • The test suite no longer asks you to confirm anything. Running Hypergate's own feature smoke tests on a Mac could raise a real confirmation prompt, for a credential the test had just invented. The suite now runs with prompts disabled.

Install

Download the installer for your platform below. Nothing else needed, not even Node.

Prefer npm? Install from the tarballs attached below: npm install -g hypergate-shell-<os>-<arch>-1.21.0.tgz hypergated-1.21.0.tgz. (hypergated is not on the public registry yet. These are the same packages, and they are what the in-app updater installs.)

Bare hypergate command-line binaries are attached too, and SHA256SUMS is signed with the GPG key at docs/release-signing-key.asc, so you can verify what you downloaded.

Assets 35
Loading