From e8aef87443877ac787c21ef0558a2858824b0f34 Mon Sep 17 00:00:00 2001 From: garrytan Date: Tue, 3 Nov 2026 04:15:40 +0000 Subject: [PATCH] docs(autoplan): say which renames and copies the lean draft name rule catches (GST-1164) Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> --- changelog.d/gsta258-s1-envrc-redact.md | 2 +- docs/unattended.md | 6 ++++-- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/changelog.d/gsta258-s1-envrc-redact.md b/changelog.d/gsta258-s1-envrc-redact.md index ab0b6444a..113ecb7dc 100644 --- a/changelog.d/gsta258-s1-envrc-redact.md +++ b/changelog.d/gsta258-s1-envrc-redact.md @@ -1,7 +1,7 @@ **Security: the lean /autoplan reviewer no longer gets `.envrc`, `.env-production` or a key pasted into an ordinary file (GST-1164, #3914).** Since v1.93.36.0 (#3897), the lean run puts the branch's draft code into a prompt that goes to an outside model provider. It left out only some secret-named untracked files: `.env` and `.env.*`, but not `.envrc` or `.env-production`. It applied no name rule to tracked files and no content check at all. So a direnv `.envrc`, a `.env-production`, a committed or edited secret file, or a key sitting in any source file could reach the provider. ### Fixed -- **`lib/autoplan-lean.ts` `captureDraft`:** the secret-name rule now covers the whole `.env*` family, `.envrc` included, every `*credentials*` name, `_netrc`, `.pgpass`, `*.jks` and `id_*_sk` keys. Matching files are never diffed, tracked or untracked, and the draft names each one it left out. A secret-named file renamed or copied on the branch stays out under both names, even when the new name looks ordinary. Every other file's patch goes through gstack's redact engine (`redactFindingSpans`), so a key in an ordinary file reaches the reviewer as ``. A patch the engine can't redact safely, including one over 1 MiB, is left out with a note. +- **`lib/autoplan-lean.ts` `captureDraft`:** the secret-name rule now covers the whole `.env*` family, `.envrc` included, every `*credentials*` name, `_netrc`, `.pgpass`, `*.jks` and `id_*_sk` keys. Matching files are never diffed, tracked or untracked, and the draft names each one it left out. A secret-named file that git sees renamed or copied on the branch stays out under both names, even when the new name looks ordinary. A secret moved without `git add`, copied unchanged, or renamed and heavily edited still reaches the draft under its new name, guarded only by the content check. Every other file's patch goes through gstack's redact engine (`redactFindingSpans`), so a key in an ordinary file reaches the reviewer as ``. A patch the engine can't redact safely, including one over 1 MiB, is left out with a note. ### Tests - `test/autoplan-lean.test.ts`: an untracked `.envrc`, `.env-production` and six other secret files stay out of `draft.diff` and the prompt; a committed and edited `.envrc` stays out of the tracked diff, and so do an `.envrc` renamed to `.envrc.local` and a `.pgpass` renamed to `pg.txt`; a fake key in an untracked file and in a working-tree edit to a tracked file comes out redacted. All four fail on main at b42ad1e. diff --git a/docs/unattended.md b/docs/unattended.md index be490f6b5..913dce009 100644 --- a/docs/unattended.md +++ b/docs/unattended.md @@ -389,8 +389,10 @@ The example above is the full run. The first `next` also takes `--kind`: looks like a secret (the whole `.env*` family, `.envrc` included, `*.pem`, `*.key`, `*.p12`, `id_rsa` and the other SSH private keys, `.netrc`, `.npmrc`, `.pgpass`, `*credentials*`, `*secret*`) is never read, tracked or - untracked, and is left out with a note; so is a file renamed or copied from - one on the branch. Every other file's patch goes + untracked, and is left out with a note; so is either side of a rename or + copy git detects in the branch's commits or staged changes. A secret moved + without `git add`, copied unchanged, or renamed and heavily edited reaches + the draft under its new name, guarded only by the content check. Every other file's patch goes through the redact engine (`lib/redact-engine.ts`), so a key in an ordinary file reaches the reviewer as ``; a patch it can't redact safely is left out with a note. The `DRAFT:` line names the checkout it diffed (`root=`). The prompt inlines the diff in a fence longer than any tilde