fix(providers): refuse keychain restore across provider ownership (carry #3845) - #3869
Conversation
(cherry picked from commit 8ef77f7) Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com>
…er marker in the same delta [skip ci] Resolves the unresolved major finding on #3843 (discussion_r3946034145): lastIndexOf selected the later START, its END made the whole-string strip pair the first START with that END, and the malformed text vanished. Walk START-delimited segments independently so a superseded or over-bound span is emitted verbatim and only a bounded trailing span is held for the next delta. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com>
…ip ci] (cherry picked from commit 73abec9) Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com>
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. 🗂️ Base branches to auto review (2)
Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Team Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
✅ Deterministic PR hygiene checks passed. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 924b65799d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
리뷰 · 우선순위 66 / 80이 PR은 기여자 #3845(luvs01)을 릴리스 트레인 레이어 5( 이 캐리는 테스트는 두 축입니다. (1) 주의할 점은 소유 판별이 문자열 접두사라는 점입니다. provider 이름에
메인테이너의 판단이 필요한 지점
너의 추천 이 댓글은 grok-bot이 작성했습니다 |
2 participants
Summary
Carries #3845 by @luvs01: restoring a provider from the keychain now rejects references that belong to another provider, while a provider's own active and pool accounts still restore. Security-sensitive (credential handling): the independent security review verdict is appended below before merge.
(carried/reimplemented from #3845; Co-authored-by trailer in the commit)
Verification
Checklist
Manual review chain (integrate bottom-up; stack: null, no native stack)
codex/rt-m1-3532devcodex/rt-m2-3840codex/rt-m3-3837codex/rt-m4-3843codex/rt-m5-3845codex/rt-m6-2033Verification policy (maintainer instruction, this train): local test suite / typecheck / build were NOT RUN; branches pushed with
--no-verify. Lower layers carry[skip ci]; the full Cross-platform CI (lane=all, Windows shards included) runs once at the chain top head and is the exact-head evidence for the cumulative tree.Layer 5 of 6. Review this PR's diff only.
Independent security review (astra explorer, read-only, 2026-09-07) — PASS
Chain-wide static review of all six layers (source-intent match, Co-authored-by attribution, TypeScript imports/signatures, citation-marker test trace): PASS, no blockers.
Maintainer integration decision (MAINTAINERS.md, dev-only admin integration): @lidge-jun integrates this manual chain into
devbottom-up. Exact chain-top evidence: Cross-platform CI run 34106345180 at head6eadb1658(lane=all: Linux 4/4, macOS 2/2 + control, Windows 6/6, gates, storage policy, api usage, keyring ×3, npm-global ×3, docker smoke, aggregateci= success). Tested tree7621cac89equals the prospective merge tree oforigin/dev@ece556a6e+ chain top. Independent chain review PASS; #3845 security review PASS (see #3869). Local suites NOT RUN by maintainer instruction. This is maintainer integration, not self-approval. Lower-layer PR runs are skipped/cancelled by design ([skip ci]); they are not passing evidence on their own.