Skip to content

fix: debt batch j03-cli-debt-d-0651 - #926

Merged
acamarata merged 3 commits into
mainfrom
job/j03-cli-debt-d-0551
Oct 29, 2026
Merged

acamarata merged 3 commits into
mainfrom
job/j03-cli-debt-d-0551

Conversation

@acamarata

@acamarata acamarata commented Oct 20, 2026 •

Copy link
Copy Markdown
Collaborator

Codex-built debt batch; one commit per row. Fixes D-0651: narrow plugin machine-execution guard to restored secret bundles, keep plugin tools advertised, update docs and E421 text.

@acamarata acamarata changed the title fix: debt batch j03-cli-debt-d-0551 fix: debt batch j03-cli-debt-d-0651 Oct 29, 2026
@acamarata

Copy link
Copy Markdown
Collaborator Author

Review fixes pushed in c1d7198:

  1. router.go:177 — guard now checks invoke.SecretsRestored() instead of NSELF_INVOKED_BY; machine-invoked plugin calls without a restored bundle run normally.
  2. expose.go/schema.go — added TestExposure case proving plugin commands remain advertised on MCP; gate is enforced at exec time, not exposure time.
  3. Docs & E421 — updated MCP-Server.md (lines 24, 50, 71, 77, 219), MCP-Tools.md:314 and codes_invoke.go E421 text to describe the secret-bundle gate.
  4. Tests — added TestMachinePluginExecutionWithoutSecretsRuns, TestMachinePluginExecutionWithSecretsRefused, TestProxyBinaryAtRejectsEscape; all pass.
  5. PR metadata — title and body now reference D-0651.

@acamarata
acamarata force-pushed the job/j03-cli-debt-d-0551 branch from c1d7198 to 1e61c16 Compare October 29, 2026 16:23
@acamarata

Copy link
Copy Markdown
Collaborator Author

Rebased onto origin/main and resolved the secretenv.go doc-comment conflict by keeping main's wording (which already reflects the E421 refusal introduced in this branch). All internal/plugin and internal/invoke tests pass with -mod=vendor; force-pushed to job/j03-cli-debt-d-0551.

…s (D-0651)

- Guard in execPluginBinary now checks invoke.SecretsRestored() instead of
  NSELF_INVOKED_BY alone; machine-invoked plugin calls without secrets run.
- Add SecretsRestored/TestingSetSecretsRestored in internal/invoke to track
  whether RestoreSecretArgv replaced placeholders in this process.
- Update E421 text and MCP docs to describe the secret-bundle gate at exec
  time while keeping plugin tools advertised on machine surfaces.
- Add tests for machine-invoked plugin execution without secrets, with
  secrets, ProxyBinaryAt containment, and plugin advertisement.
@acamarata
acamarata force-pushed the job/j03-cli-debt-d-0551 branch from 1e61c16 to e9c979e Compare October 29, 2026 23:05
@acamarata
acamarata merged commit 8f7968c into main Oct 29, 2026
27 of 36 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant