From 1baa8c36304bfda49d20185b9e36d65d0bbda667 Mon Sep 17 00:00:00 2001 From: Diego Rodrigues de Sa e Souza Date: Thu, 3 Sep 2026 13:02:52 -0300 Subject: [PATCH] fix(quality): re-point the zcodeProtocol public-creds allowlist to line 313 (#12615) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `check:public-creds` has been failing on every open PR against release/v3.8.51, twice over for the same literal: ✗ 1 entrada(s) obsoleta(s) na allowlist — zcodeProtocol.ts:302 ✗ 1 credencial(is) pública(s) como string literal — zcodeProtocol.ts L313 Both are the same `clientId: \`omniroute-${process.pid}\`` in the local ZCode handshake. Nothing regressed: the allowlist key is `file:line:value`, so an edit that shifted the statement from 302 to 313 invalidated the frozen key and the gate reported the entry as stale AND the literal as new. Re-pointed the key and its comment. The literal itself is unchanged and still frozen — the entry is not removed and the detector is not weakened (the gate's own test still asserts that renaming the value to `upstream-client-` is flagged). `tests/unit/check-public-creds.test.ts` synthesizes the source with a newline count to land the statement on the allowlisted line; that count moves with it, 302 -> 313, so the test keeps pinning the real contract instead of a stale one. Also documented the sharp edge inline: keying by line number means any edit near this statement breaks the gate in two places at once, and the fix is to re-point the line, never to drop the entry. Tightening the key to `file:value` would remove the trap but widens what the entry freezes, so it is left as a note rather than folded into a base-red drain. check:public-creds OK (3 frozen literals), check-public-creds tests 20/20, check:tracked-artifacts OK, prettier clean. --- scripts/check/check-public-creds.mjs | 8 ++++++-- tests/unit/check-public-creds.test.ts | 5 ++++- 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/scripts/check/check-public-creds.mjs b/scripts/check/check-public-creds.mjs index 7e065705d0..62549001bb 100644 --- a/scripts/check/check-public-creds.mjs +++ b/scripts/check/check-public-creds.mjs @@ -90,14 +90,18 @@ const ENV_KEY_RE = /(clientId|clientSecret|apiKey)Env\s*:/; // The MiniMax family was extracted from services/usage.ts into services/usage/minimax.ts // (god-file decomposition), so the FP moved with the getMiniMaxUsage signature. // -// open-sse/executors/zcodeProtocol.ts L302: `clientId: \`omniroute-${process.pid}\`` +// open-sse/executors/zcodeProtocol.ts L313: `clientId: \`omniroute-${process.pid}\`` // is the per-process identifier in the local ZCode app-server handshake. It is // generated from the process PID, is not an upstream OAuth/client credential, and // must remain visible in the wire contract. Frozen by file:line:value key. +// NOTE: the key includes the LINE, so any edit that shifts this statement breaks +// the gate twice over — a stale-entry error plus a "new violation" for the same +// literal. That is what happened here (L302 -> L313). Re-point the line; do not +// remove the entry. export const KNOWN_LITERAL_CREDS = new Set([ "open-sse/services/usage/minimax.ts:213:minimax", // TODO(6A.8): pre-existing FP — TS fn-param type, not a credential (getMiniMaxUsage signature) "open-sse/services/usage/minimax.ts:213:minimax-cn", // TODO(6A.8): pre-existing FP — TS fn-param type, not a credential (getMiniMaxUsage signature) - "open-sse/executors/zcodeProtocol.ts:302:omniroute-${process.pid}", // local per-process ZCode handshake ID, not an upstream credential + "open-sse/executors/zcodeProtocol.ts:313:omniroute-${process.pid}", // local per-process ZCode handshake ID, not an upstream credential ]); /** diff --git a/tests/unit/check-public-creds.test.ts b/tests/unit/check-public-creds.test.ts index 5531c5d336..b726218495 100644 --- a/tests/unit/check-public-creds.test.ts +++ b/tests/unit/check-public-creds.test.ts @@ -68,7 +68,10 @@ test("allowlist freezes a literal by file:line:value key", () => { }); test("allowlist preserves the local ZCode handshake client ID without weakening credential detection", () => { - const src = `${"\n".repeat(301)}clientId: \`omniroute-\${process.pid}\`,`; + // 312 newlines puts the statement on line 313, which is where it lives in + // zcodeProtocol.ts today. The allowlist key carries the line number, so this + // literal has to be kept in step with the source (it moved 302 -> 313). + const src = `${"\n".repeat(312)}clientId: \`omniroute-\${process.pid}\`,`; assert.deepEqual( findLiteralCreds(src, KNOWN_LITERAL_CREDS, "open-sse/executors/zcodeProtocol.ts"), []