Module sidecar_guard 

Launch-token authentication for the supervised uar-sidecar process.

The host that launches the sidecar writes a per-launch 256-bit token as the first line of the sidecar’s stdin. SidecarGuard then admits a request only when it carries that token, names the sidecar’s own loopback authority, and carries no Origin header. A loopback port is not an authentication boundary: any local process, and a web page through DNS rebinding or a cross-origin request, can reach it. See the OpenSpec change sidecar-launch-security.

Structs

HostAuthenticated

Marker installed only after the outer launch-token guard admits a request. Inner authentication may trust host assertions only when this marker exists.

InvalidLaunchToken

The first stdin line was missing or was not a well-formed launch token.

SidecarGuard

Per-request admission for the sidecar port.

SidecarLaunchToken

The token the host handed the sidecar over stdin.

Functions

enforce

Outermost middleware of a token-authenticated sidecar.