mirror of
https://github.com/fabro-sh/fabro.git
synced 2026-09-15 23:32:46 +00:00
370a6c96d5
The GitHub App token reached the agent's git commands through the origin URL: after the clone fabro ran `git remote set-url origin` with the token embedded, then tracked which generation the URL carried, held an embed lease across every push so a refresh could not rewrite the URL mid-operation, re-embedded on the first auth-shaped push failure in case the agent had rewritten origin, and redacted the URL out of every log line and output tail. The token showed in `git remote -v` and `.git/config`. The driver now installs ambient credentials for a checkout: one credential-store line beside the checkout and a `credential.helper` entry pointing at it, with the remote URL untouched. Fabro's part is `credentials.rs`: the token source, one mint for the clone, one resolve per push operation, and the facet call. The clone carries the token per call and installs it afterwards; the ACP refresh tick rewrites the store instead of the URL; fabro's own pushes pin one resolved token for the whole operation and pass it per call, so nothing is ever re-embedded and a retry after replication lag presents the same token by construction. Gone with the URL: `push_credentials.rs`, `redact.rs`, the lease and drift repair in `git_push`, `RefreshOutcome`, and the `credential_action` and `refresh_error` fields on push attempt events. Stored events that carry those keys still read. A failed store install after the clone now fails setup, where a failed `set-url` used to be logged and repaired by the first push. The one remaining caller of the URL redactor, the server's repository probe, uses `DisplaySafeUrl::redact_in`. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| fabro-cli | ||
| fabro-mcp-server | ||
| fabro-server | ||
| fabro-spa | ||