Files
oh-my-pi/packages/coding-agent/test
iacore 54008bce99 fix(secrets): round-tripped unconfigured credential-shaped tokens through reversible obfuscation
With secrets.enabled (Hide Secrets), a credential-shaped token not present
in secrets.yml or the environment fell through to pi-ai's irreversible
[*_token_redacted] rewrite in transform-messages. The model echoed that
placeholder into edit-tool old_text, which could never match the real
bytes on disk, breaking exact-match edits of any file containing such a
token.

Route the same token shapes (SENSITIVE_TOKEN_RE, now exported from
pi-ai) through the SecretObfuscator as a built-in obfuscate-mode regex
entry: the provider sees reversible keyed placeholders, and
deobfuscateToolArguments restores the real bytes before tool execution.
Hide Secrets' contract is unchanged — credential bytes still never
reach the provider; pi-ai's redaction stays as the backstop for hosts
without an obfuscator.

Fixes #6968
2026-07-30 15:14:00 +08:00
..
2026-07-30 04:25:32 +02:00
2026-07-27 16:43:53 +02:00
2026-07-27 16:43:53 +02:00
2026-07-27 16:43:53 +02:00
2026-07-30 04:25:32 +02:00
2026-07-27 16:43:53 +02:00
2026-07-27 16:43:53 +02:00
2026-07-30 07:49:43 +02:00
2026-07-27 16:43:53 +02:00
2026-07-27 16:43:53 +02:00
2026-07-30 04:25:32 +02:00
2026-07-30 04:25:32 +02:00
2026-07-27 16:43:53 +02:00
2026-06-26 18:43:32 +02:00
2026-07-01 00:07:30 +00:00
2026-05-30 18:08:51 +02:00
2026-05-30 18:08:51 +02:00
2026-07-27 16:43:53 +02:00
2026-07-30 04:25:32 +02:00
2026-06-24 13:44:47 +00:00