Repository navigation
fix(collect): redact rejected URL diagnostics - #384
Merged
Merged
Conversation
what changed: Fix #378; mcp.mjs, collect-remote.mjs, MCP/CLI regression coverage, architecture map, changelog and test inventory. why: Restore the existing collection input and credential-handling contract. This is a bug fix with one remedy; no alternative design was set aside. what it touched: Shared remote collection seams; existing ADR-0033/0034 behavior. No new domain term or public interface. what you verified: verified - dispatch/MCP red-first reproduction and passing combined regression run (83 tests); CLI integration regressions pass in the broader command run. The commit gate runs the required complete offline suite before accepting this commit. what you got wrong and fixed: mistake - running six full suites concurrently exceeded the default 3900-second budget; where - local commit validation on this Windows host; impact - affected hooks refused commits before publication; cause - excess concurrent subprocess and filesystem work; fix - retry one commit at a time with the ADR-0142 timeout extension (RESEARCH_KIT_GATE_TIMEOUT=7920); verified - the required full-suite commit gate accepted the commit.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Rejected collection URLs could echo a caller's GitHub credential into an MCP transcript or CLI stderr. Pass the existing URL refusal through the existing pattern-based redactor on both output paths.
Fixes #378
what changed: Redacted MCP and CLI rejected-URL diagnostics, with integration regressions for synthetic credentials in URL userinfo and query parameters.
why: Restore the existing rule that credentials in diagnostics are redacted, including credentials different from the server's own token. No alternative design was set aside.
what it touched:
lib/mcp.mjs,bin/collect-remote.mjs, MCP/CLI tests, architecture rows, changelog and test inventory. Existing ADR-0033/0034 behavior; no new domain terms or public interface.what you verified: verified - combined dispatch/MCP regressions (83 passed), CLI/artifact CLI run (120 passed), and isolated MCP coverage. The required full suite was accepted by the repository commit gate.
what you got wrong and fixed: mistake - running six full suites concurrently exceeded the default 3900-second budget; where - local commit validation on this Windows host; impact - affected hooks refused commits before publication; cause - excess concurrent subprocess and filesystem work; fix - retry one commit at a time with the ADR-0142 timeout extension (RESEARCH_KIT_GATE_TIMEOUT=7920); verified - the required full-suite commit gate accepted the commit.
Full-suite detail: verified - 1779 passed, 0 failed, 12 unsupported capabilities on win32/Node 24.20.0 in 1842.2 seconds. The gate's documented local unsupported-capability opt-in was used; CI exercises its supported platforms separately.