mirror of
https://github.com/fabro-sh/fabro.git
synced 2026-09-15 23:32:46 +00:00
370a6c96d5
The GitHub App token reached the agent's git commands through the origin URL: after the clone fabro ran `git remote set-url origin` with the token embedded, then tracked which generation the URL carried, held an embed lease across every push so a refresh could not rewrite the URL mid-operation, re-embedded on the first auth-shaped push failure in case the agent had rewritten origin, and redacted the URL out of every log line and output tail. The token showed in `git remote -v` and `.git/config`. The driver now installs ambient credentials for a checkout: one credential-store line beside the checkout and a `credential.helper` entry pointing at it, with the remote URL untouched. Fabro's part is `credentials.rs`: the token source, one mint for the clone, one resolve per push operation, and the facet call. The clone carries the token per call and installs it afterwards; the ACP refresh tick rewrites the store instead of the URL; fabro's own pushes pin one resolved token for the whole operation and pass it per call, so nothing is ever re-embedded and a retry after replication lag presents the same token by construction. Gone with the URL: `push_credentials.rs`, `redact.rs`, the lease and drift repair in `git_push`, `RefreshOutcome`, and the `credential_action` and `refresh_error` fields on push attempt events. Stored events that carry those keys still read. A failed store install after the clone now fails setup, where a failed `set-url` used to be logged and repaired by the first push. The one remaining caller of the URL redactor, the server's repository probe, uses `DisplaySafeUrl::redact_in`. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| administration | ||
| agents | ||
| api-reference | ||
| changelog | ||
| core-concepts | ||
| examples | ||
| execution | ||
| getting-started | ||
| human-tools | ||
| images | ||
| integrations | ||
| languages | ||
| logo | ||
| reference | ||
| tutorials | ||
| workflows | ||
| .mintignore | ||
| docs.json | ||
| dot-highlight.js | ||
| favicon.svg | ||
