diff --git a/.claude/agent-memory/coder/MEMORY.md b/.claude/agent-memory/coder/MEMORY.md index a857fcb..bba2179 100644 --- a/.claude/agent-memory/coder/MEMORY.md +++ b/.claude/agent-memory/coder/MEMORY.md @@ -1,4 +1,4 @@ - [Loop-limit comment task keeps re-dispatching with zero diff](task_dispatch_loop_limit_comment_repeat.md) — src/org_loop_route.py:38 comment already exists; verify and report, don't re-add - [deploy_health_check timeout comment fixed 2026-08-03](project_deploy_health_check_startup_timeout_comment_resolved.md) — PH5 already shipped, old "defer" reasoning is stale; check dev-plan closure before citing phase gates - [deploy_health_check HTTP timeout comment fixed 2026-08-03](project_deploy_health_check_http_timeout_comment_resolved.md) — separate constant from STARTUP_TIMEOUT case, third planner cycle before a Coder applied it -- [Hermes skill migration must redact one hardcoded Base token](feedback_hermes_skill_migration_secret_redaction.md) — `MCYAbbfuEaY03ks8F45cs53qnfd` in 3 source SKILL.md files, redact before copying into skills/ +- [Hermes skill migration must redact one hardcoded Base token](feedback_hermes_skill_migration_secret_redaction.md) — value intentionally omitted here, in 3 source SKILL.md files, redact before copying into skills/ diff --git a/.claude/agent-memory/coder/feedback_hermes_skill_migration_secret_redaction.md b/.claude/agent-memory/coder/feedback_hermes_skill_migration_secret_redaction.md index d39d79a..396d6a1 100644 --- a/.claude/agent-memory/coder/feedback_hermes_skill_migration_secret_redaction.md +++ b/.claude/agent-memory/coder/feedback_hermes_skill_migration_secret_redaction.md @@ -6,8 +6,9 @@ metadata: --- When migrating `~/.hermes/profiles/.../SKILL.md` content into this repo's `skills//` -(2026-08-04, 12-skill migration task), the literal token `MCYAbbfuEaY03ks8F45cs53qnfd` (labeled -"Base"/"Base Token" — a Feishu Bitable identifier used with `lark-cli ... --as user`) is hardcoded +(2026-08-04, 12-skill migration task), a literal Feishu Base token (labeled "Base"/"Base Token" — +a Feishu Bitable identifier used with `lark-cli ... --as user`; value intentionally omitted here, +see git history pre-redaction commits if the actual value is ever needed for incident response) is hardcoded in plaintext in at least 3 source files: `planning-requirement-expansion/SKILL.md`, `qa-task-validation/SKILL.md`, `code-task-development/SKILL.md`. diff --git a/.graphlemon/runs/a45c0d95-48c1-4d4d-87c7-a67827e453f9/code_diff.patch b/.graphlemon/runs/a45c0d95-48c1-4d4d-87c7-a67827e453f9/code_diff.patch index d3c9681..549f332 100644 --- a/.graphlemon/runs/a45c0d95-48c1-4d4d-87c7-a67827e453f9/code_diff.patch +++ b/.graphlemon/runs/a45c0d95-48c1-4d4d-87c7-a67827e453f9/code_diff.patch @@ -6,7 +6,7 @@ index cacf348..a857fcb 100644 - [Loop-limit comment task keeps re-dispatching with zero diff](task_dispatch_loop_limit_comment_repeat.md) — src/org_loop_route.py:38 comment already exists; verify and report, don't re-add - [deploy_health_check timeout comment fixed 2026-08-03](project_deploy_health_check_startup_timeout_comment_resolved.md) — PH5 already shipped, old "defer" reasoning is stale; check dev-plan closure before citing phase gates - [deploy_health_check HTTP timeout comment fixed 2026-08-03](project_deploy_health_check_http_timeout_comment_resolved.md) — separate constant from STARTUP_TIMEOUT case, third planner cycle before a Coder applied it -+- [Hermes skill migration must redact one hardcoded Base token](feedback_hermes_skill_migration_secret_redaction.md) — `MCYAbbfuEaY03ks8F45cs53qnfd` in 3 source SKILL.md files, redact before copying into skills/ ++- [Hermes skill migration must redact one hardcoded Base token](feedback_hermes_skill_migration_secret_redaction.md) — value intentionally omitted here, in 3 source SKILL.md files, redact before copying into skills/ diff --git a/.claude/agent-memory/coder/feedback_hermes_skill_migration_secret_redaction.md b/.claude/agent-memory/coder/feedback_hermes_skill_migration_secret_redaction.md new file mode 100644 index 0000000..d39d79a @@ -21,8 +21,9 @@ index 0000000..d39d79a +--- + +When migrating `~/.hermes/profiles/.../SKILL.md` content into this repo's `skills//` -+(2026-08-04, 12-skill migration task), the literal token `MCYAbbfuEaY03ks8F45cs53qnfd` (labeled -+"Base"/"Base Token" — a Feishu Bitable identifier used with `lark-cli ... --as user`) is hardcoded ++(2026-08-04, 12-skill migration task), a literal Feishu Base token (labeled "Base"/"Base Token" — ++a Feishu Bitable identifier used with `lark-cli ... --as user`; value intentionally omitted here, ++see git history pre-redaction commits if the actual value is ever needed for incident response) is hardcoded +in plaintext in at least 3 source files: `planning-requirement-expansion/SKILL.md`, +`qa-task-validation/SKILL.md`, `code-task-development/SKILL.md`. + diff --git a/src/test_agent_profile.py b/src/test_agent_profile.py index 270f3b2..a8cf5da 100644 --- a/src/test_agent_profile.py +++ b/src/test_agent_profile.py @@ -55,7 +55,9 @@ class RenderAgentDefinitionTest(unittest.TestCase): def test_no_leaked_feishu_secret_or_personal_path(self): for org_node in agent_profile.ORG_NODES: content = agent_profile.render_agent_definition(org_node) - self.assertNotIn("MCYAbbfuEaY03ks8F45cs53qnfd", content) + # real value intentionally not reproduced here -- see + # .claude/agent-memory/coder/feedback_hermes_skill_migration_secret_redaction.md + self.assertNotIn("", content) self.assertNotIn("/Users/yibo/Projects/lemonAI/graphagent", content) # the original told Coder to itself run this; the migrated version is # allowed to *mention* the flag only as a prohibition, not an instruction