mirror of
https://github.com/fabro-sh/fabro.git
synced 2026-11-03 07:22:44 +00:00
0e670e9234
Fabro's run, session, turn, message and pair IDs are ULIDs. A ULID occasionally has enough distinct characters to cross the secret scanner's 4.5-bit entropy threshold, and the stream redaction then rewrites the Web UI link to `/runs/REDACTED` and the run branch to `fabro/run/REDACTED`. Two nightly releases in the last week failed on `attach_replays_completed_detached_run` this way, and each fix so far protected one field at a time. Teach the entropy scanner the format instead: a token that is exactly 26 uppercase Crockford base32 characters and decodes to a timestamp between 2020 and 2100 is an identifier, not a secret, and is left alone wherever it appears. Trailing `-ULID`, `_ULID` and `=ULID` segments are stripped before measuring, so `20261020-<id>` and `<secret>-<id>` are handled, and the secret in the latter is still found. The gitleaks credential patterns run on every token as before. This mirrors detect-secrets' built-in UUID filter. A secret would have to take exactly this shape and land in the date window to be missed, which is about one in a hundred of the already rare tokens encoded as 26 uppercase base32 characters. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| commands | ||
| shared | ||
| sleep_inhibitor | ||
| args.rs | ||
| command_context.rs | ||
| gh.rs | ||
| landing.rs | ||
| local_server.rs | ||
| logging.rs | ||
| main.rs | ||
| manifest_args.rs | ||
| mcp_servers.rs | ||
| server_client.rs | ||
| server_runs.rs | ||
| user_config.rs | ||