fix(memory): harden preference secret classifier - #79
senoldogann wants to merge 20 commits into
Conversation
|
@codex review |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: caf97d75bd
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a56f1089fb
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7abc8e1382
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c0921df782
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Self-review found and reproduced one additional compositional credential bypass after the previous review: an allowlisted follower could hide a copular value, e.g. |
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 490f7b8aa1
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex address the current test-only RED on head |
|
To use Codex here, create an environment for this repo. |
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f1d26ce6a6
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 00e6fc27c0
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5d2878a24d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
|
@codex review Please review the exact current head |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2a6728fc2e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| r"(?i)[ \t]+(?:" | ||
| r"is|was|were|been|should|must|" | ||
| r"(?:will|would|can|could|may|might|shall)[ \t]+be" | ||
| r")(?:[ \t]+|[ \t]*[:=][ \t]*)(?P<value>\S+)" |
There was a problem hiding this comment.
Fresh evidence beyond the resolved copula cases is that an explicit assignment such as password manager entry equals swordfish still bypasses classification: manager is allowlisted, while neither assignment regex recognizes equals, so structured extraction and direct PreferenceStore.record calls can persist the secret. Treat word-form assignment operators such as equals as assignments before applying the safe-prose exemption.
AGENTS.md reference: AGENTS.md:L33-L36
Useful? React with 👍 / 👎.
| introduces_assignment = ( | ||
| raw_follower.endswith((":", "=")) and bool(trailing.strip()) | ||
| ) or _DELIMITED_CREDENTIAL_VALUE_RE.search(trailing) is not None |
There was a problem hiding this comment.
When an ordinary preference mentions a URL after safe credential prose—for example preference: security=use the password manager workflow in https://vault.example—the unrestricted delimiter search treats the colon in https: as a credential assignment and rejects the preference. This regresses both explicit extraction and direct store writes for non-secret security preferences containing URLs; restrict trailing delimiter detection to assignment positions or explicitly exclude URI schemes.
AGENTS.md reference: AGENTS.md:L33-L36
Useful? React with 👍 / 👎.
1 participant
Fixes #77.
Classifier policy
password,passwd,api key, compactapikey,api_key,api-key, bounded spaces/tabs,token,secret):/=credential assignments fail closedis,was,were), perfect-tense terminalbeen, existing policy connectors (should,must), and bounded modal +beforms (will,would,can,could,may,might,shall)TDD evidence
55743d44/ CI #294: 16 failed, 1097 passed, 2 skipped.ac269556/ CI #296: 5 failed, 1113 passed, 2 skipped.apikeyreview REDa56f1089/ CI #298: 3 failed, 1118 passed, 2 skipped; fixed by7abc8e1382.dc1f28eb/ CI #306: 7 failed, 1121 passed, 2 skipped; fixed byc0921df782.174796df/ CI #314: 7 failed, 1128 passed, 2 skipped; fixed by490f7b8aa1ffd73a49c32a42c3e1c70eaca000de.58d00e7d/ CI #324: 5 failed, 1135 passed, 2 skipped; fixed byf1d26ce6a64dc469ab97be4cf2dd063578b06015.dd0f9e8c/ CI #330: 6 failed, 1140 passed, 2 skipped; fixed by00e6fc27c0f138f7469f7f82acd71eb717b7564d.5d2878a2/ CI #335: 9 failed, 1146 passed, 2 skipped; fixed by55eab97465bd8373082d04efae81f1096eb1c331.29d67d3f/ CI #341: 12 failed, 1155 passed, 2 skipped; fixed bydf3f42586dc7fbd046df8c07927a7076f2513c7d, with trailing-newline cleanup2a6728fc2e028422c68f0fdfdc69927d8acd1342.2a6728fc2e028422c68f0fdfdc69927d8acd1342: 1167 passed, 2 skipped; Ruff clean; Pyright 0 errors / 0 warnings / 0 informations; Linux Rust GREEN; macOS real-backend Rust GREEN.Merge discipline
Do not merge until automated review has completed on the exact final head SHA and every inline finding has been reproduced/fixed or concretely closed. After merge, observe main CI independently before #78 / PR D work proceeds.