Documentation
¶
Overview ¶
Command wardyn-scan is Wardyn's in-sandbox workspace scanner. It runs INSIDE a throwaway governed scan run (a later wave's launcher), walks the mounted workspace, and ships the raw ScanFacts back to the control plane so the profile is DERIVED control-plane-side (facts-out, not profile-out — the sandbox never carries authority; see internal/workspacescan DeriveProfile).
Upload contract (mirrors wardyn-rec's brokered upload — the proxy injects the run token, so the sandbox NEVER holds it):
PUT ${WARDYN_PROXY_URL}/wardyn/v1/scan-results/${WARDYN_RUN_ID}
Content-Type: application/json
body: json(workspacescan.ScanFacts)
The wardyn-proxy local route /wardyn/v1/scan-results/ (handleBrokerScanResult) forwards this to POST-authenticated /api/v1/internal/scan-results/{runID} with the run token injected; the control plane rejects a runID that doesn't match the token's run (cross-run pollution guard). No Authorization header is set here on purpose — any sandbox-supplied one is stripped by the proxy.
Env:
WARDYN_WORKSPACE_DIR dir to scan (default /home/agent/work) WARDYN_PROXY_URL proxy base URL (required) WARDYN_RUN_ID this run's id (required)
Source Files