Well, the software for now is designed for trusted groups of users, so appart from making sure users can't access sessions of others in the same pool, there's not much.
For context, it's sent in every request of claude code and codex (only in http, not websocket) so we don't have to handle anything, the server just rewrites the auth headers of the request, keeping it intact out of that.
4 comments
[ 0.16 ms ] story [ 13.6 ms ] threadI built slashwork.sh as an offload marketplace for this exact thing but public facing and VM-wrapped for security.
Curious about how u address the trust layer and context offloading.
For context, it's sent in every request of claude code and codex (only in http, not websocket) so we don't have to handle anything, the server just rewrites the auth headers of the request, keeping it intact out of that.
"This project does not claim it is legal lmao"