OpeItcLoc03/claude-skills
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore(tasks): remove setup-projects-meta-token-leak task

Browse Source 
User request — kill it.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
vitya
2026-05-06 22:52:17 +03:00
parent 011a8b42f2
commit f2d1e6e2ae
1 changed files with 0 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
.tasks/STATUS.md
View File

@@ -87,14 +87,6 @@ _Updated: 2026-05-05 (interns-repo-read-skill-updates done — both skills 0.2.0
---
## ⚪ [setup-projects-meta-token-leak] — fix token leak: `setup-projects-meta` falls back to `https://USER:TOKEN@host/...` clone URL on auth failure, persists token in `.git/config`
**Status:** ready
**Where I stopped:** (not started) — surfaced 2026-05-06 during factory-bootstrap field-test on fresh Win11 laptop. Phase 4 of `/setup-projects-meta` ran `git clone https://git.kzntsv.site/...` first; it failed with `Failed to authenticate user` (Bash tool runs git non-interactive; GCM not available there). Skill auto-retried with `git clone https://USER:TOKEN@host/...` — succeeded BUT git persists the URL with embedded creds in `.git/config` of the cloned repo. Two repos affected (`projects-meta-mcp`, `projects-wiki`). Field-test mitigation: PAT rotated, `git remote set-url origin <clean-url>` in both clones.
**Next action:** in `setup-projects-meta/SKILL.md` Phase 4, replace the credential-in-URL retry with the per-invocation extraheader form: `git -c http.extraheader="Authorization: token $T" clone <url> <target>`. The extraheader is request-scoped — git does NOT persist it in the cloned repo's `.git/config`. Verify on the field-test ноуте: re-clone, `git -C <repo> config --get remote.origin.url` should print the bare URL, no token. Bump `setup-projects-meta` version (PATCH — security fix). Update SKILL.md README. Field-test artefact: `.factory/L0/install-log.md` шаг 11c-1 в gitea `OpeItcLoc03/factory`.
**Branch:** master
<!-- created-by: vitya@.meeting-room (director) / from: factory-bootstrap field-test / 2026-05-06 -->
---
## ⚪ [refresh-project-bootstrap] — Run the `project-bootstrap` skill in this repo to refresh its layout to the canonical state (git, .gitignore, README.md, .wiki/, .tasks/, CLAUDE.md). The skill handles both greenfield bootstrap and refresh of existing repos.
**Status:** ready