Skip to content

sandbox: the hanzo CLI 8.5.914, which speaks as HANZO_API_KEY; 1.3.10 - #71

Merged
zeekay merged 1 commit into
mainfrom
sandbox-1.3.10
Nov 7, 2026
Merged

zeekay merged 1 commit into
mainfrom
sandbox-1.3.10

Conversation

@zeekay

@zeekay zeekay commented Nov 7, 2026

Copy link
Copy Markdown
Member

HANZO_CLI_VERSION 8.5.913 → 8.5.914 (hanzoai/cli#47), checksums read from the downloaded tarballs and equal to the release's sidecars:

  • amd64 d461bc7912775419246686d95adb93948176e47bdde385534e1d75bcf4e5bd1a
  • arm64 cd845eb3851348c18b502e509c70f923d61bbb520608772d3c64e9fcd0e67ed9

Why: a box leased with an API key holds no CLI session (not signed in), and signed in as anyone but the key, agent sessions get on the key's runs answers 404 (sessions belong to their actor). 8.5.914 reads HANZO_API_KEY as the bearer. Verified with the released arm64 binary, empty HOME, the Grok bot's key: hanzo agent sessions get sess_92f2… answers the session (actor hanzo/hanzo/z).

Image 1.3.10. Rolling it out is a digest pin in universe charts/app/values/hanzo/cloud.yaml (SANDBOX_IMAGE_DIGEST_*), which restarts cloud.

https://claude.ai/code/session_015XYKLnBbrbajqj1GpRydF8

A box leased with an API key holds no CLI session, so its `hanzo`
said `not signed in`, and signed in as a person it answered 404 for
every session the key had opened. 8.5.914 reads HANZO_API_KEY as the
bearer of every cloud command.

Claude-Session: https://claude.ai/code/session_015XYKLnBbrbajqj1GpRydF8
@zeekay
zeekay merged commit 7af4645 into main Nov 7, 2026
12 of 18 checks passed
@zeekay
zeekay deleted the sandbox-1.3.10 branch November 7, 2026 10:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant