宜博 / lemongraph

Commit b39f411470048df8dbc606f47a9dc7e2a0e4b1e7

Authored by bboonnee
1 parent 0b35896d

security: redact leaked Feishu Base token literal before first push 

The literal token value was committed in plaintext across 4 files
(agent-memory notes, a stored run artifact, and a test assertion)
while documenting that it had been redacted from migrated skill
files -- the documentation itself failed to redact it. Replacing
with placeholders/omission ahead of pushing this repo to a remote
for the first time; the pre-existing commits (2a71bd5, 0cbf4b1,
14dee05) still contain the plaintext value in history.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Inline Side-by-side
Showing 4 changed files with 11 additions and 7 deletions
.claude/agent-memory/coder/MEMORY.md
  View file @b39f411
1 1 - [Loop-limit comment task keeps re-dispatching with zero diff](task_dispatch_loop_limit_comment_repeat.md) — src/org_loop_route.py:38 comment already exists; verify and report, don't re-add
2 2 - [deploy_health_check timeout comment fixed 2026-08-03](project_deploy_health_check_startup_timeout_comment_resolved.md) — PH5 already shipped, old "defer" reasoning is stale; check dev-plan closure before citing phase gates
3 3 - [deploy_health_check HTTP timeout comment fixed 2026-08-03](project_deploy_health_check_http_timeout_comment_resolved.md) — separate constant from STARTUP_TIMEOUT case, third planner cycle before a Coder applied it
4   -- [Hermes skill migration must redact one hardcoded Base token](feedback_hermes_skill_migration_secret_redaction.md) — `MCYAbbfuEaY03ks8F45cs53qnfd` in 3 source SKILL.md files, redact before copying into skills/
  4 +- [Hermes skill migration must redact one hardcoded Base token](feedback_hermes_skill_migration_secret_redaction.md) — value intentionally omitted here, in 3 source SKILL.md files, redact before copying into skills/
... ...
.claude/agent-memory/coder/feedback_hermes_skill_migration_secret_redaction.md
  View file @b39f411
... ... @@ -6,8 +6,9 @@ metadata:
6 6 ---
7 7  
8 8 When migrating `~/.hermes/profiles/.../SKILL.md` content into this repo's `skills/<skill_id>/`
9   -(2026-08-04, 12-skill migration task), the literal token `MCYAbbfuEaY03ks8F45cs53qnfd` (labeled
10   -"Base"/"Base Token" — a Feishu Bitable identifier used with `lark-cli ... --as user`) is hardcoded
  9 +(2026-08-04, 12-skill migration task), a literal Feishu Base token (labeled "Base"/"Base Token" —
  10 +a Feishu Bitable identifier used with `lark-cli ... --as user`; value intentionally omitted here,
  11 +see git history pre-redaction commits if the actual value is ever needed for incident response) is hardcoded
11 12 in plaintext in at least 3 source files: `planning-requirement-expansion/SKILL.md`,
12 13 `qa-task-validation/SKILL.md`, `code-task-development/SKILL.md`.
13 14  
... ...
.graphlemon/runs/a45c0d95-48c1-4d4d-87c7-a67827e453f9/code_diff.patch
  View file @b39f411
... ... @@ -6,7 +6,7 @@ index cacf348..a857fcb 100644
6 6 - [Loop-limit comment task keeps re-dispatching with zero diff](task_dispatch_loop_limit_comment_repeat.md) — src/org_loop_route.py:38 comment already exists; verify and report, don't re-add
7 7 - [deploy_health_check timeout comment fixed 2026-08-03](project_deploy_health_check_startup_timeout_comment_resolved.md) — PH5 already shipped, old "defer" reasoning is stale; check dev-plan closure before citing phase gates
8 8 - [deploy_health_check HTTP timeout comment fixed 2026-08-03](project_deploy_health_check_http_timeout_comment_resolved.md) — separate constant from STARTUP_TIMEOUT case, third planner cycle before a Coder applied it
9   -+- [Hermes skill migration must redact one hardcoded Base token](feedback_hermes_skill_migration_secret_redaction.md) — `MCYAbbfuEaY03ks8F45cs53qnfd` in 3 source SKILL.md files, redact before copying into skills/
  9 ++- [Hermes skill migration must redact one hardcoded Base token](feedback_hermes_skill_migration_secret_redaction.md) — value intentionally omitted here, in 3 source SKILL.md files, redact before copying into skills/
10 10 diff --git a/.claude/agent-memory/coder/feedback_hermes_skill_migration_secret_redaction.md b/.claude/agent-memory/coder/feedback_hermes_skill_migration_secret_redaction.md
11 11 new file mode 100644
12 12 index 0000000..d39d79a
... ... @@ -21,8 +21,9 @@ index 0000000..d39d79a
21 21 +---
22 22 +
23 23 +When migrating `~/.hermes/profiles/.../SKILL.md` content into this repo's `skills/<skill_id>/`
24   -+(2026-08-04, 12-skill migration task), the literal token `MCYAbbfuEaY03ks8F45cs53qnfd` (labeled
25   -+"Base"/"Base Token" — a Feishu Bitable identifier used with `lark-cli ... --as user`) is hardcoded
  24 ++(2026-08-04, 12-skill migration task), a literal Feishu Base token (labeled "Base"/"Base Token" —
  25 ++a Feishu Bitable identifier used with `lark-cli ... --as user`; value intentionally omitted here,
  26 ++see git history pre-redaction commits if the actual value is ever needed for incident response) is hardcoded
26 27 +in plaintext in at least 3 source files: `planning-requirement-expansion/SKILL.md`,
27 28 +`qa-task-validation/SKILL.md`, `code-task-development/SKILL.md`.
28 29 +
... ...
src/test_agent_profile.py
  View file @b39f411
... ... @@ -55,7 +55,9 @@ class RenderAgentDefinitionTest(unittest.TestCase):
55 55 def test_no_leaked_feishu_secret_or_personal_path(self):
56 56 for org_node in agent_profile.ORG_NODES:
57 57 content = agent_profile.render_agent_definition(org_node)
58   - self.assertNotIn("MCYAbbfuEaY03ks8F45cs53qnfd", content)
  58 + # real value intentionally not reproduced here -- see
  59 + # .claude/agent-memory/coder/feedback_hermes_skill_migration_secret_redaction.md
  60 + self.assertNotIn("<FEISHU_BASE_TOKEN_REDACTED_PLACEHOLDER>", content)
59 61 self.assertNotIn("/Users/yibo/Projects/lemonAI/graphagent", content)
60 62 # the original told Coder to itself run this; the migrated version is
61 63 # allowed to *mention* the flag only as a prohibition, not an instruction
... ...