mirror of
https://github.com/fabro-sh/fabro.git
synced 2026-09-15 23:32:46 +00:00
370a6c96d5
The GitHub App token reached the agent's git commands through the origin URL: after the clone fabro ran `git remote set-url origin` with the token embedded, then tracked which generation the URL carried, held an embed lease across every push so a refresh could not rewrite the URL mid-operation, re-embedded on the first auth-shaped push failure in case the agent had rewritten origin, and redacted the URL out of every log line and output tail. The token showed in `git remote -v` and `.git/config`. The driver now installs ambient credentials for a checkout: one credential-store line beside the checkout and a `credential.helper` entry pointing at it, with the remote URL untouched. Fabro's part is `credentials.rs`: the token source, one mint for the clone, one resolve per push operation, and the facet call. The clone carries the token per call and installs it afterwards; the ACP refresh tick rewrites the store instead of the URL; fabro's own pushes pin one resolved token for the whole operation and pass it per call, so nothing is ever re-embedded and a retry after replication lag presents the same token by construction. Gone with the URL: `push_credentials.rs`, `redact.rs`, the lease and drift repair in `git_push`, `RefreshOutcome`, and the `credential_action` and `refresh_error` fields on push attempt events. Stored events that carry those keys still read. A failed store install after the clone now fails setup, where a failed `set-url` used to be logged and repaired by the first push. The one remaining caller of the URL redactor, the server's repository probe, uses `DisplaySafeUrl::redact_in`. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| profiles | ||
| agent_profile.rs | ||
| apply_patch.lark | ||
| apply_patch.rs | ||
| cli.rs | ||
| compaction.rs | ||
| config.rs | ||
| context_window.rs | ||
| error.rs | ||
| event.rs | ||
| file_tracker.rs | ||
| history.rs | ||
| lib.rs | ||
| local_sandbox.rs | ||
| loop_detection.rs | ||
| mcp_integration.rs | ||
| memory.rs | ||
| native_tool.rs | ||
| question_tools.rs | ||
| sandbox.rs | ||
| session.rs | ||
| skills.rs | ||
| subagent.rs | ||
| task_reminder.rs | ||
| test_support.rs | ||
| todo_runtime.rs | ||
| todo_tools.rs | ||
| tool_execution.rs | ||
| tool_permissions.rs | ||
| tool_registry.rs | ||
| tools.rs | ||
| truncation.rs | ||
| types.rs | ||
| web_search.rs | ||