Repository navigation
fix(megarepo): never persist credentialed clone URLs - #2292
Conversation
agent-identity: agent/effect-utils/effect-utils-manager agent-persona: generalist agent-supervisor: unavailable agent-tool: OMP agent-tool-version: 18.10.2 agent-runtime: OMP 18.10.2 agent-model: anthropic/claude-opus-5-5
schickling-assistant
added
the
type:bug
Storybook Previews
Report historyPR 2292 · 2026-11-03 09:46 UTC
PR 2292 · 2026-11-03 08:12 UTC
PR 2292 · 2026-11-03 07:59 UTC
|
Pipeline traces24 jobs; 7 successful, 0 failed, 0 cancelled, 17 skipped
All other jobs (19)
Main baseline samples (by job): tested-tree n=7, default-ref-policy n=7, pr-buck2-tools n=0, test-megarepo-store-gc n=0, pr-reviews-resolved n=7, test-live-deploy-ci-tools n=7, publish-products n=7, promote-published n=7, quality n=0, weaver n=0, pr-a-inert-buck n=0, build-products n=0, test[runner=namespace-profile-linux-x86-64] n=0, test-playwright-utils n=0, test-integration-restate n=0, test[runner=namespace-profile-macos-arm64] n=0, cargo n=0, test-playwright-tui-react n=0, trusted-buck2-remote-cache-proof n=7, test-integration-notion n=7, deploy-storybooks n=7, consumer-smoke n=7, source-shape n=0, notify-alignment n=7. 17 job(s) without a start time are omitted from the timeline, not measured as zero. |
agent-identity: agent/effect-utils/effect-utils-manager agent-persona: generalist agent-supervisor: unavailable agent-tool: OMP agent-tool-version: 18.10.2 agent-runtime: OMP 18.10.2 agent-model: anthropic/claude-opus-5-5
agent-identity: agent/effect-utils/effect-utils-manager agent-persona: generalist agent-supervisor: unavailable agent-tool: OMP agent-tool-version: 18.10.2 agent-runtime: OMP 18.10.2 agent-model: anthropic/claude-opus-5-5
|
Independent review GO at exact head 623d630, after 3 rounds. Round 1 NO-GO: stripping credentials during sync split the source identity (the store preflight still derived token@host paths), and lock and add still persisted the original URL. Round 2 NO-GO: legacy locks were still accepted, and the retention of schema issue input was undocumented. Final design: credentialed HTTP(S) sources fail closed at one shared schema, which covers config (JSON/KDL, nested), Posted on behalf of @schickling
|
|
Merge record: CI is green at exact head 623d630, and the independent exact-head GO is above. Enqueued. Posted on behalf of @schickling
|
|
Merge record (effect-utils-manager): head 623d630, CI green (36 checks), independent review GO at this head, no Hypermerge label. Enqueuing. Posted on behalf of @schickling
|
agent-identity: agent/effect-utils/effect-utils-manager agent-persona: generalist agent-supervisor: unavailable agent-tool: OMP agent-tool-version: 18.10.2 agent-runtime: OMP 18.10.2 agent-model: anthropic/claude-opus-5-5
|
GO carried to exact head f4e17c0. The delta from the reviewed head 623d630 is one hunk in cli/commands/add.ts: the AddCommandError message for an ordinary invalid reference goes back to the historical generic text (the CLI contract baseline that ejected run 41608837823). Credentialed references still use the redacted credential guidance. The bounded Buck megarepo lane passes locally. Posted on behalf of @schickling
|
|
Merge record: CI is green at exact head f4e17c0, with GO carried above. Re-enqueued. Posted on behalf of @schickling
|
|
Merge record (effect-utils-manager): head f4e17c0, CI green (35 checks), independent review GO at this head, no Hypermerge label. Enqueuing. Posted on behalf of @schickling
|
Problem
Credentialed HTTP(S) source and legacy lock URLs could persist secrets in origin/configuration and leak through tracing or store paths. Stripping only inside synchronization splits source identity across preflight and store operations.
Goal
Reject credentialed member and lock inputs before downstream identity derivation, persistence, or instrumentation. Authentication stays with credential helpers or SSH.
Decisions
Verification
devenv tasks run buck2:quick: passed.CI=1 devenv tasks run lint:check: passed.Complexity
One shared rejection schema and redaction boundary; small clone defense in depth; no new dependency or locking abstraction.
Concerns
Credentialed HTTP(S) configuration and legacy locks now fail closed. Remove embedded credentials and configure a credential helper or SSH. Enabling schema reportInput would violate the documented credential-retention constraint.
Friction & bottlenecks
Review caught source-identity splitting, legacy-lock acceptance, and an inaccurate input-retention claim; corrected all three with structured-error regression coverage.
Follow-ups
None.
References
See #1525.
Posted on behalf of @schickling
agent_identitysessionagent_personaagent_supervisoragent_toolagent_tool_versionagent_runtimeagent_modelworktree