main · last commit
13 days ago ·
7g0stsfu
ah-1jy config: trim yonote.token and mem0.api_key at load like the notifier credentials
Past Stand
bd reopen ah-1jy
| Created by | Eugene Blikh |
| Owner | bigbes@gmail.com |
| Created | 2026-08-04T23:44:00Z |
| Started | 2026-08-04T23:54:12Z |
| Updated | 2026-08-05T00:00:43Z |
| Closed | 2026-08-05T00:00:43Z |
Leftover from ah-1cx.3, which trimmed the four notifier strings (ntfy.url/token, telegram.token/api_base) at load so the value an adapter receives is exactly the value present() judged. yonote.token and mem0.api_key were not included. A padded credential passes the new blank scan correctly — it is not blank — but reaches the client with leading or trailing whitespace in the auth header and fails at REQUEST time rather than at load, which is the diagnostic gap ah-1cx.3 set out to close. The realistic source is a ${VAR} expansion picking up a trailing newline from an env file. Also cosmetic, from the same family: resolve compares vikunja.web_url untrimmed when deciding whether to derive it from url. Post-ah-1cx.6 a whitespace-only value errors out instead of silently defeating the derivation, so this is now harmless — it is just the last untrimmed comparison left in the file.
A padded yonote.token or mem0.api_key is trimmed at load, and no untrimmed string comparison against "" remains in resolve.
No outgoing dependencies.
Nothing depends on this issue.
| id | ah-1jy |
| content_hash | 8ce9b56a889ec3e5b86e47e140a10d94334118b5b72612654819617614e970a9 |
| title | config: trim yonote.token and mem0.api_key at load like the notifier credentials |
| description | Leftover from ah-1cx.3, which trimmed the four notifier strings (ntfy.url/token, telegram.token/api_base) at load so the value an adapter receives is exactly the value present() judged. yonote.token and mem0.api_key were not included. A padded credential passes the new blank scan correctly — it is not blank — but reaches the client with leading or trailing whitespace in the auth header and fails at REQUEST time rather than at load, which is the diagnostic gap ah-1cx.3 set out to close. The realistic source is a ${VAR} expansion picking up a trailing newline from an env file. Also cosmetic, from the same family: resolve compares vikunja.web_url untrimmed when deciding whether to derive it from url. Post-ah-1cx.6 a whitespace-only value errors out instead of silently defeating the derivation, so this is now harmless — it is just the last untrimmed comparison left in the file. |
| design | |
| acceptance_criteria | A padded yonote.token or mem0.api_key is trimmed at load, and no untrimmed string comparison against "" remains in resolve. |
| notes | |
| status | closed |
| priority | 4 |
| issue_type | chore |
| assignee | NULL |
| estimated_minutes | NULL |
| created_at | 2026-08-04T23:44:00Z |
| created_by | Eugene Blikh |
| owner | bigbes@gmail.com |
| updated_at | 2026-08-05T00:00:43Z |
| closed_at | 2026-08-05T00:00:43Z |
| closed_by_session | |
| external_ref | NULL |
| spec_id | |
| compaction_level | 0 |
| compacted_at | NULL |
| compacted_at_commit | NULL |
| original_size | NULL |
| sender | |
| ephemeral | 0 |
| wisp_type | |
| pinned | 0 |
| is_template | 0 |
| mol_type | |
| work_type | |
| source_system | |
| metadata | �{} |
| source_repo | |
| close_reason | Done in baa8075. yonote.token and mem0.api_key were the two credentials ah-1cx.3 missed when it trimmed the four notifier strings. A padded credential is NOT blank, so it passes the set-but-blank scan correctly, but it then reached yonote.New / mem0.New with the whitespace still attached and went into the Authorization / X-API-Key header verbatim — failing at REQUEST time with a 401 far from the config file, which is precisely the diagnostic gap ah-1cx.3 set out to close. The realistic source is a ${VAR} expansion picking up the trailing newline of an env-file line. Both are now strings.TrimSpace'd in resolve, in the same literals that already trim their base URLs, so the value the client receives is exactly the value present() judged. The same change removes the last untrimmed == "" comparison in resolve — the vikunja.web_url derivation test — but NOT naively: trimming that test alone would have REGRESSED, because a whitespace-only web_url would then silently take the value derived from vikunja.url, where today it defeats the derivation and gets caught by ah-1cx.6's http(s) check. So vikunja.web_url was added to blankScanFields and is now reported at load by name, and the scan's doc comment records the move. Cover: a vikunja.web_url row in TestLoadBlankValues's sibling table, plus three subtests pinning that padded yonote.token / mem0.api_key — literal and ${VAR}-expanded — arrive trimmed. |
| event_kind | |
| actor | |
| target | |
| payload | |
| await_type | |
| await_id | |
| timeout_ns | 0 |
| waiters | |
| hook_bead | |
| role_bead | |
| agent_state | |
| last_activity | NULL |
| role_type | |
| rig | |
| due_at | NULL |
| defer_until | NULL |
| no_history | 0 |
| started_at | 2026-08-04T23:54:12Z |
| is_blocked | 0 |
| issue_id | ah-1jy |
| label | milestone:v0.1.0 |
| id | 019fcf29-a3d0-7c19-b72c-69e777b395c2 |
| issue_id | ah-1jy |
| event_type | created |
| actor | Eugene Blikh |
| old_value | |
| new_value | |
| comment | NULL |
| created_at | 2026-08-05T02:44:00Z |
| id | 019fcf32-fa29-7d0f-9384-e3119d061fb7 |
| issue_id | ah-1jy |
| event_type | status_changed |
| actor | Eugene Blikh |
| old_value | {"id":"ah-1jy","title":"config: trim yonote.token and mem0.api_key at load like the notifier credentials","description":"Leftover from ah-1cx.3, which trimmed the four notifier strings (ntfy.url/token, telegram.token/api_base) at load so the value an adapter receives is exactly the value present() judged.\n\nyonote.token and mem0.api_key were not included. A padded credential passes the new blank scan correctly — it is not blank — but reaches the client with leading or trailing whitespace in the auth header and fails at REQUEST time rather than at load, which is the diagnostic gap ah-1cx.3 set out to close. The realistic source is a ${VAR} expansion picking up a trailing newline from an env file.\n\nAlso cosmetic, from the same family: resolve compares vikunja.web_url untrimmed when deciding whether to derive it from url. Post-ah-1cx.6 a whitespace-only value errors out instead of silently defeating the derivation, so this is now harmless — it is just the last untrimmed comparison left in the file.","acceptance_criteria":"A padded yonote.token or mem0.api_key is trimmed at load, and no untrimmed string comparison against \"\" remains in resolve.","status":"open","priority":4,"issue_type":"chore","owner":"bigbes@gmail.com","created_at":"2026-08-04T23:44:00Z","created_by":"Eugene Blikh","updated_at":"2026-08-04T23:44:00Z"} |
| new_value | {"status":"in_progress"} |
| comment | NULL |
| created_at | 2026-08-05T02:54:12Z |
| id | 019fcf38-efab-73f3-bc55-22db659513c2 |
| issue_id | ah-1jy |
| event_type | closed |
| actor | Eugene Blikh |
| old_value | |
| new_value | Done in baa8075. yonote.token and mem0.api_key were the two credentials ah-1cx.3 missed when it trimmed the four notifier strings. A padded credential is NOT blank, so it passes the set-but-blank scan correctly, but it then reached yonote.New / mem0.New with the whitespace still attached and went into the Authorization / X-API-Key header verbatim — failing at REQUEST time with a 401 far from the config file, which is precisely the diagnostic gap ah-1cx.3 set out to close. The realistic source is a ${VAR} expansion picking up the trailing newline of an env-file line. Both are now strings.TrimSpace'd in resolve, in the same literals that already trim their base URLs, so the value the client receives is exactly the value present() judged. The same change removes the last untrimmed == "" comparison in resolve — the vikunja.web_url derivation test — but NOT naively: trimming that test alone would have REGRESSED, because a whitespace-only web_url would then silently take the value derived from vikunja.url, where today it defeats the derivation and gets caught by ah-1cx.6's http(s) check. So vikunja.web_url was added to blankScanFields and is now reported at load by name, and the scan's doc comment records the move. Cover: a vikunja.web_url row in TestLoadBlankValues's sibling table, plus three subtests pinning that padded yonote.token / mem0.api_key — literal and ${VAR}-expanded — arrive trimmed. |
| comment | NULL |
| created_at | 2026-08-05T03:00:42Z |
| id | 019fcf42-05d6-70b3-a234-607faecc9d60 |
| issue_id | ah-1jy |
| event_type | label_added |
| actor | Eugene Blikh |
| old_value | NULL |
| new_value | NULL |
| comment | Added label: milestone:v0.1.0 |
| created_at | 2026-08-05T03:10:38Z |
No comments.
Close reason
Done in baa8075. yonote.token and mem0.api_key were the two credentials ah-1cx.3 missed when it trimmed the four notifier strings. A padded credential is NOT blank, so it passes the set-but-blank scan correctly, but it then reached yonote.New / mem0.New with the whitespace still attached and went into the Authorization / X-API-Key header verbatim — failing at REQUEST time with a 401 far from the config file, which is precisely the diagnostic gap ah-1cx.3 set out to close. The realistic source is a ${VAR} expansion picking up the trailing newline of an env-file line. Both are now strings.TrimSpace'd in resolve, in the same literals that already trim their base URLs, so the value the client receives is exactly the value present() judged. The same change removes the last untrimmed == "" comparison in resolve — the vikunja.web_url derivation test — but NOT naively: trimming that test alone would have REGRESSED, because a whitespace-only web_url would then silently take the value derived from vikunja.url, where today it defeats the derivation and gets caught by ah-1cx.6's http(s) check. So vikunja.web_url was added to blankScanFields and is now reported at load by name, and the scan's doc comment records the move. Cover: a vikunja.web_url row in TestLoadBlankValues's sibling table, plus three subtests pinning that padded yonote.token / mem0.api_key — literal and ${VAR}-expanded — arrive trimmed.