ADR-0006 names two chokepoints, and apps/substrate/src/engine/git-scrub.ts implements both:
scrubRemotesCommand — post-clone, rewrite remote.origin.url and drop credential / extraheader config.redactCapturedGitConfigCommand — a second pass over everything a capture would persist: every .git/config under the workspace including submodules', plus .git-credentials and .netrc.
The container path (packages/runtime-cf/src/sandbox-cf.ts) now has the first, as of #90. It has no counterpart to the second. Uncovered:
- Submodule
.git/config files, if gitCheckout recurses submodules — the post-clone scrub only touches the top-level remote. Unverified: whether the SDK's gitCheckout recurses, or configures a credential helper, was not confirmed during review.
~/.gitconfig and ~/.git-credentials in the container's home, if anything writes them.- Anything a workload writes after the clone —
git remote add, git config credential.helper store.
The substrate's second pass exists because it runs before a backup is taken to R2, and the container path has no equivalent snapshot step — which is why this is a smaller gap than it looks, not a live leak. But container filesystems are reused across executions (see the rm -rf ${targetDir} note in sandbox-cf.ts), so a credential a workload writes does outlive its run.
Worth either porting the redaction pass to run at the end of a container execution, or writing down explicitly why the container path needs only one chokepoint.
Raised by review on #90.
ADR-0006 names two chokepoints, and
apps/substrate/src/engine/git-scrub.tsimplements both:scrubRemotesCommand— post-clone, rewriteremote.origin.urland dropcredential/extraheaderconfig.redactCapturedGitConfigCommand— a second pass over everything a capture would persist: every.git/configunder the workspace including submodules', plus.git-credentialsand.netrc.The container path (
packages/runtime-cf/src/sandbox-cf.ts) now has the first, as of #90. It has no counterpart to the second. Uncovered:.git/configfiles, ifgitCheckoutrecurses submodules — the post-clone scrub only touches the top-level remote. Unverified: whether the SDK'sgitCheckoutrecurses, or configures a credential helper, was not confirmed during review.~/.gitconfigand~/.git-credentialsin the container's home, if anything writes them.git remote add,git config credential.helper store.The substrate's second pass exists because it runs before a backup is taken to R2, and the container path has no equivalent snapshot step — which is why this is a smaller gap than it looks, not a live leak. But container filesystems are reused across executions (see the
rm -rf ${targetDir}note insandbox-cf.ts), so a credential a workload writes does outlive its run.Worth either porting the redaction pass to run at the end of a container execution, or writing down explicitly why the container path needs only one chokepoint.
Raised by review on #90.