main · last commit
13 days ago ·
7g0stsfu
ah-w4r config: trim vikunja.url and vikunja.token, and blank-scan agent_tasks.target_bucket
Past Stand
bd reopen ah-w4r
| Created by | Eugene Blikh |
| Owner | bigbes@gmail.com |
| Created | 2026-08-05T00:01:02Z |
| Started | 2026-08-05T00:07:20Z |
| Updated | 2026-08-05T00:09:20Z |
| Closed | 2026-08-05T00:09:20Z |
The last of the untrimmed-credential family, found while doing ah-1jy. 1. vikunja.url and vikunja.token are still stored untrimmed. A padded url errors via ah-1cx.6's http(s) check so it is visible, but a padded token goes to the board API verbatim in the Authorization header and fails at request time — exactly the failure class ah-1jy just fixed for yonote.token and mem0.api_key, and on the one service that is MANDATORY. 2. resolve still has one untrimmed string comparison left outside ah-1jy's scope: 'if cfg.AgentTasks.TargetBucket == ""' (config.go around line 641). Trimming it ALONE would be a regression — 'target_bucket: " "' currently produces a clear 'is not a canonical bucket name' error, and a trimmed test would silently apply the 'triage' default instead. It needs a blankScanFields entry in the same change, exactly the way vikunja.web_url got one in baa8075.
A padded vikunja.token arrives trimmed at the board client; a whitespace-only agent_tasks.target_bucket is reported by name at load rather than silently defaulting. No untrimmed string comparison against "" remains in resolve.
No outgoing dependencies.
Nothing depends on this issue.
| id | ah-w4r |
| content_hash | b0223b29b0f28d414b4eb3433ad5845e3666468ebc01a3f4df4e1cc8cc10a844 |
| title | config: trim vikunja.url and vikunja.token, and blank-scan agent_tasks.target_bucket |
| description | The last of the untrimmed-credential family, found while doing ah-1jy. 1. vikunja.url and vikunja.token are still stored untrimmed. A padded url errors via ah-1cx.6's http(s) check so it is visible, but a padded token goes to the board API verbatim in the Authorization header and fails at request time — exactly the failure class ah-1jy just fixed for yonote.token and mem0.api_key, and on the one service that is MANDATORY. 2. resolve still has one untrimmed string comparison left outside ah-1jy's scope: 'if cfg.AgentTasks.TargetBucket == ""' (config.go around line 641). Trimming it ALONE would be a regression — 'target_bucket: " "' currently produces a clear 'is not a canonical bucket name' error, and a trimmed test would silently apply the 'triage' default instead. It needs a blankScanFields entry in the same change, exactly the way vikunja.web_url got one in baa8075. |
| design | |
| acceptance_criteria | A padded vikunja.token arrives trimmed at the board client; a whitespace-only agent_tasks.target_bucket is reported by name at load rather than silently defaulting. No untrimmed string comparison against "" remains in resolve. |
| notes | |
| status | closed |
| priority | 4 |
| issue_type | chore |
| assignee | NULL |
| estimated_minutes | NULL |
| created_at | 2026-08-05T00:01:02Z |
| created_by | Eugene Blikh |
| owner | bigbes@gmail.com |
| updated_at | 2026-08-05T00:09:20Z |
| closed_at | 2026-08-05T00:09:20Z |
| closed_by_session | |
| external_ref | NULL |
| spec_id | |
| compaction_level | 0 |
| compacted_at | NULL |
| compacted_at_commit | NULL |
| original_size | NULL |
| sender | |
| ephemeral | 0 |
| wisp_type | |
| pinned | 0 |
| is_template | 0 |
| mol_type | |
| work_type | |
| source_system | |
| metadata | �{} |
| source_repo | |
| close_reason | Done in b96e3a6. The last of the untrimmed-credential family (ah-1cx.3 → ah-1jy → this), and the only ones on a MANDATORY service. A padded vikunja.url was at least visible — validateHTTPURL rejects it (ah-1cx.6) — but a padded vikunja.token went to the board API verbatim in the Authorization header and failed at request time with a 401 far from the config file. Both are now trimmed in resolve, and url is trimmed BEFORE web_url's derivation so whitespace cannot leak into the derived value; web_url's own comparison is now a plain == "" again, since the trim happens above it. agent_tasks.target_bucket was resolve's last untrimmed emptiness test: trimming it ALONE would have been a regression, because 'target_bucket: " "' currently produces a clear 'is not a canonical bucket name' error and a trimmed test would silently apply the triage default instead — so it joins blankScanFields in the same change, exactly as vikunja.web_url did in baa8075. blankScanFields' doc comment now states the rule outright: trimming an emptiness test in resolve and adding its field to the scan are ONE change, never two. Cover: an agent_tasks.target_bucket row in TestLoadBlankValues's sibling table, a padded-vikunja-credentials subtest that also asserts the derived web_url comes out clean, and a padded-target_bucket subtest asserting padding is trimmed rather than rejected. |
| event_kind | |
| actor | |
| target | |
| payload | |
| await_type | |
| await_id | |
| timeout_ns | 0 |
| waiters | |
| hook_bead | |
| role_bead | |
| agent_state | |
| last_activity | NULL |
| role_type | |
| rig | |
| due_at | NULL |
| defer_until | NULL |
| no_history | 0 |
| started_at | 2026-08-05T00:07:20Z |
| is_blocked | 0 |
| issue_id | ah-w4r |
| label | milestone:v0.1.0 |
| id | 019fcf39-3bc9-7ad1-9fd8-c2b0ac20df63 |
| issue_id | ah-w4r |
| event_type | created |
| actor | Eugene Blikh |
| old_value | |
| new_value | |
| comment | NULL |
| created_at | 2026-08-05T03:01:02Z |
| id | 019fcf3e-fefc-79d7-8073-a987a1e5d09d |
| issue_id | ah-w4r |
| event_type | status_changed |
| actor | Eugene Blikh |
| old_value | {"id":"ah-w4r","title":"config: trim vikunja.url and vikunja.token, and blank-scan agent_tasks.target_bucket","description":"The last of the untrimmed-credential family, found while doing ah-1jy.\n\n1. vikunja.url and vikunja.token are still stored untrimmed. A padded url errors via ah-1cx.6's http(s) check so it is visible, but a padded token goes to the board API verbatim in the Authorization header and fails at request time — exactly the failure class ah-1jy just fixed for yonote.token and mem0.api_key, and on the one service that is MANDATORY.\n\n2. resolve still has one untrimmed string comparison left outside ah-1jy's scope: 'if cfg.AgentTasks.TargetBucket == \"\"' (config.go around line 641). Trimming it ALONE would be a regression — 'target_bucket: \" \"' currently produces a clear 'is not a canonical bucket name' error, and a trimmed test would silently apply the 'triage' default instead. It needs a blankScanFields entry in the same change, exactly the way vikunja.web_url got one in baa8075.","acceptance_criteria":"A padded vikunja.token arrives trimmed at the board client; a whitespace-only agent_tasks.target_bucket is reported by name at load rather than silently defaulting. No untrimmed string comparison against \"\" remains in resolve.","status":"open","priority":4,"issue_type":"chore","owner":"bigbes@gmail.com","created_at":"2026-08-05T00:01:02Z","created_by":"Eugene Blikh","updated_at":"2026-08-05T00:01:02Z"} |
| new_value | {"status":"in_progress"} |
| comment | NULL |
| created_at | 2026-08-05T03:07:20Z |
| id | 019fcf40-d4b7-7860-b29a-5bf7820173f3 |
| issue_id | ah-w4r |
| event_type | closed |
| actor | Eugene Blikh |
| old_value | |
| new_value | Done in b96e3a6. The last of the untrimmed-credential family (ah-1cx.3 → ah-1jy → this), and the only ones on a MANDATORY service. A padded vikunja.url was at least visible — validateHTTPURL rejects it (ah-1cx.6) — but a padded vikunja.token went to the board API verbatim in the Authorization header and failed at request time with a 401 far from the config file. Both are now trimmed in resolve, and url is trimmed BEFORE web_url's derivation so whitespace cannot leak into the derived value; web_url's own comparison is now a plain == "" again, since the trim happens above it. agent_tasks.target_bucket was resolve's last untrimmed emptiness test: trimming it ALONE would have been a regression, because 'target_bucket: " "' currently produces a clear 'is not a canonical bucket name' error and a trimmed test would silently apply the triage default instead — so it joins blankScanFields in the same change, exactly as vikunja.web_url did in baa8075. blankScanFields' doc comment now states the rule outright: trimming an emptiness test in resolve and adding its field to the scan are ONE change, never two. Cover: an agent_tasks.target_bucket row in TestLoadBlankValues's sibling table, a padded-vikunja-credentials subtest that also asserts the derived web_url comes out clean, and a padded-target_bucket subtest asserting padding is trimmed rather than rejected. |
| comment | NULL |
| created_at | 2026-08-05T03:09:20Z |
| id | 019fcf42-0739-70af-8237-eadeada52040 |
| issue_id | ah-w4r |
| event_type | label_added |
| actor | Eugene Blikh |
| old_value | NULL |
| new_value | NULL |
| comment | Added label: milestone:v0.1.0 |
| created_at | 2026-08-05T03:10:38Z |
No comments.
Close reason