security(laptop-repo-keeper): secret guard misses credentials inside wholly untracked directories — autocommit snapshot pushes them (Codex P1 on #1740, merged unacted)

Defect

The laptop repo-keeper's secret guard can be bypassed by directory nesting: the guard regex runs over collapsed git status output, so a credential file inside a wholly untracked directory (status shows only ?? config/) is never matched — and the autocommit snapshot then commits and pushes it. Codex flagged this as a P1 on PR #1740 and reproduced it in a temp clone; the PR merged without the finding being acted on. Defect confirmed present on main 2026-10-29 (audit: REAL + never engaged + merged anyway).

The Codex finding (verbatim, PR #1740)

Check individual untracked paths in the secret guard

When a sensitive file is inside a wholly untracked directory, this status output can contain only the directory name, such as ?? config/, so the regex never sees config/credentials.json. The subsequent snapshot commits the nested file despite the advertised secret-path guard. I reproduced this with a temporary hatch clone; the enabled autocommit script then pushed that snapshot. Inspect individual untracked paths, as the size check already does, rather than relying on collapsed status entries.

Finding: #1740 (comment) (filed against nixos/home/laptop-repo-keeper.sh line 78, PR #1740)

Fix direction (as Codex prescribed)

Inspect individual untracked paths in the secret guard — as the size check already does — rather than relying on collapsed status entries.

Related but distinct: #1751 (laptop-untracked-review bare git commit sweeping pre-staged work) is a different mechanism in a sibling script; this issue is only the keeper secret-guard bypass.

Source

Codex review-value audit 2026-10-29 (research_notes/codex-review-value-20261029/findings.md §2, best catch #2): 636 Codex findings classified, this one REAL-CATCH, never engaged, PR merged anyway. Verification: defect confirmed present on main 2026-10-29.

CODE-1131

Agent note — picked up (OpenChamber scheduled lane)

Agent: queue worker (`repo-worker-code`), lane `bf419306-c4ef-470f-a553-beabf93239de`
Session / ID: queue task 3423 (small_fix), claimed 2026-11-02T23:09Z
Found via: atomic queue claim in `repo-health-code-pilot`.
Next: verify guard on current main; no competing PR (none open mentions security(laptop-repo-keeper): secret guard misses credentials inside wholly untracked directories — autocommit snapshot pushes them (Codex P1 on #1740, merged unacted) #2268).

Agent note — PR opened, parking for CI (OpenChamber scheduled lane)

Agent: queue worker (`repo-worker-code`), lane `bf419306-c4ef-470f-a553-beabf93239de` · task 3423, 2026-11-02T23:24Z
State: PR test(repo-keeper): untracked secret never swept into snapshots (fixes #2268) #4647 open (branch `queue/3423-2268-untracked-secret-guard`): regression test proving an untracked `config/credentials.json` never enters keeper snapshots. Keeper script unchanged — guard already correct on main.
Finding: the bypass mechanism (`add -A`) died in `79cec6d53` (Oct 28); the issue is resolved by test-pinning, not by a guard change. Closes security(laptop-repo-keeper): secret guard misses credentials inside wholly untracked directories — autocommit snapshot pushes them (Codex P1 on #1740, merged unacted) #2268 on merge.
Next: resume when CI is green → verify → merge → complete task. Parked 20 min.

agent-note:v1 — state: picked-up (task 3423, OpenChamber scheduled lane)

Agent: repo-worker-code; origin=openchamber-scheduled-lane.
Resumed awaiting_ci. Freshly verified security(laptop-repo-keeper): secret guard misses credentials inside wholly untracked directories — autocommit snapshot pushes them (Codex P1 on #1740, merged unacted) #2268 OPEN and PR test(repo-keeper): untracked secret never swept into snapshots (fixes #2268) #4647 OPEN, non-draft, mergeable; required basic guard remains QUEUED since 00:43:11Z; CodeRabbit neutral.
Prior checkpoint records the passing synthetic-secret guard regression test. No files changed in this resume.
Next: park now under the CI rule; resume by rechecking the guard and standing merge criteria.

agent-note:v1 — state: parked (task 3423, OpenChamber scheduled lane)

Agent: repo-worker-code; origin=openchamber-scheduled-lane.
Fresh evidence: security(laptop-repo-keeper): secret guard misses credentials inside wholly untracked directories — autocommit snapshot pushes them (Codex P1 on #1740, merged unacted) #2268 OPEN; PR test(repo-keeper): untracked secret never swept into snapshots (fixes #2268) #4647 OPEN, non-draft, mergeable. Required basic guard remains QUEUED since 00:43:11Z; CodeRabbit neutral.
Disposition: parked 20 minutes under the CI rule. No files changed in this resume; prior checkpoint records the passing synthetic-secret guard regression test.
Resume: recheck required checks fresh; then merge and complete only when green and standing criteria are met.

agent-note:v1 — state: handed off

Queue task #3423 is handed to OpenCode for execution.

Session: ses_e5e60f497bbffetjgWi7MhtMft
Lane: opencode
Worker claim: repo-worker-code
Task: fix security(laptop-repo-keeper): secret guard misses credentials inside wholly untracked directories — autocommit snapshot pushes them (Codex P1 on #1740, merged unacted) #2268: detect secret-shaped files nested in wholly untracked directories; synthetic-only regression scope is in task fix(id): validate outbox mail headers (#2404) #3423.

Navigation Menu

Repository navigation

security(laptop-repo-keeper): secret guard misses credentials inside wholly untracked directories — autocommit snapshot pushes them (Codex P1 on #1740, merged unacted) #2268

Defect

The Codex finding (verbatim, PR #1740)

Fix direction (as Codex prescribed)

Source

11 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

security(laptop-repo-keeper): secret guard misses credentials inside wholly untracked directories — autocommit snapshot pushes them (Codex P1 on #1740, merged unacted) #2268

Description

Defect

The Codex finding (verbatim, PR #1740)

Fix direction (as Codex prescribed)

Source

Activity

developing-today commented on Oct 29, 2026

dezren39 commented on Nov 2, 2026

dezren39 commented on Nov 2, 2026

11 remaining items

dezren39 commented on Nov 3, 2026

dezren39 commented on Nov 3, 2026

dezren39 commented on Nov 3, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions