From 29d0b1990d658044d2df9385bc4c4a0986007ead Mon Sep 17 00:00:00 2001 From: Murphy Freelance <70611945+murphy-freelance@users.noreply.github.com> Date: Fri, 10 Jul 2026 19:48:42 +0200 Subject: [PATCH] =?UTF-8?q?fix:=20review=20findings=20=E2=80=94=20env-var?= =?UTF-8?q?=20netrc=20write=20hygiene,=20network-vs-auth=20errors,=20insta?= =?UTF-8?q?ller=20collision=20guard,=20docs?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Fable 5 --- README.md | 3 ++- docs/codex-support-design.md | 4 ++-- install-codex.sh | 4 ++++ skills/setup/SKILL.md | 27 ++++++++++++++++++++++++--- skills/triage/SKILL.md | 6 ++++-- 5 files changed, 36 insertions(+), 8 deletions(-) diff --git a/README.md b/README.md index e0269eb..33fbe32 100644 --- a/README.md +++ b/README.md @@ -66,7 +66,8 @@ l'allegato va poi trascinato in Jira a mano. ## Aggiornare la conoscenza dei repo Quando la tua codebase cambia in modo visibile agli utenti, dalla -cartella del repo esegui `/gw-triage:map-repo` e segui le istruzioni: +cartella del repo esegui `/gw-triage:map-repo` (Claude Code) o +`$map-repo` (Codex) e segui le istruzioni: il profilo aggiornato viene pushato qui e gli altri lo ricevono con `/plugin marketplace update gw-triage` (Claude Code) o `git pull` nella cartella clonata (Codex). diff --git a/docs/codex-support-design.md b/docs/codex-support-design.md index 2e89544..aef9a8e 100644 --- a/docs/codex-support-design.md +++ b/docs/codex-support-design.md @@ -91,8 +91,8 @@ listings. saving (3-attempt limit, network-vs-auth error distinction — as today). - **Migration**: if credentials already exist in the session env or in - `~/.claude/settings.json` `env`, verify them and offer to migrate - them into the netrc; suggest removing the settings.json entries + `~/.claude/settings.json` `env`, verify them and migrate them into + the netrc automatically; suggest removing the settings.json entries (leftover shell-profile check stays). - The temp-netrc-for-literals dance disappears: the real netrc file IS the store, written before verification and deleted only if diff --git a/install-codex.sh b/install-codex.sh index b6fcdd7..c956ba7 100755 --- a/install-codex.sh +++ b/install-codex.sh @@ -9,6 +9,10 @@ dest="${HOME}/.agents/skills" mkdir -p "$dest" for skill in triage setup map-repo; do + if [ -e "$dest/$skill" ] && [ ! -L "$dest/$skill" ]; then + echo "errore: $dest/$skill esiste già e non è un link simbolico — rimuovilo e rilancia" >&2 + exit 1 + fi ln -sfn "$repo_dir/skills/$skill" "$dest/$skill" echo "linked $dest/$skill -> $repo_dir/skills/$skill" done diff --git a/skills/setup/SKILL.md b/skills/setup/SKILL.md index 72632ce..fa0b1d2 100644 --- a/skills/setup/SKILL.md +++ b/skills/setup/SKILL.md @@ -28,7 +28,9 @@ English for precision; never quote it to the user. as "il token" and never repeat its value. Never inline a literal token on a shell command line — it ends up in the transcript and the process list. Write credentials into the netrc file with the file-writing -tool, then let curl read them via `--netrc-file`. +tool — or, for values that live only in session env vars, via shell +redirection with unexpanded `$VAR` references — then let curl read +them via `--netrc-file`. The verification call used throughout: @@ -42,8 +44,10 @@ The verification call used throughout: verification call. - `200` → tell the user (Italian) the token already works and ask whether they want to replace it anyway. If not, stop. - - anything else → tell them the stored token no longer works + - `401`/`403` → tell them the stored token no longer works (probably expired or revoked) and continue to Step 1. + - anything else (timeout, DNS) → network problem, not credentials: + report it (Italian) and stop. 2. Otherwise look for legacy credentials, in order: - session env: `test -n "$JIRA_EMAIL" && test -n "$JIRA_API_TOKEN" && echo session || echo unset` - `~/.claude/settings.json` (if it exists): `env.JIRA_EMAIL` / @@ -51,11 +55,28 @@ The verification call used throughout: If found in either place: write them to the netrc (Step 2 format, chmod 600) and run the verification call. + + **Important — how to write the netrc depends on where the values + came from:** + - Values read from `~/.claude/settings.json` are literals you + already hold: write the netrc with the file-writing tool as usual. + - Session-env credentials must never be echoed or expanded by you: + write the file via shell redirection with unexpanded references, + e.g. + + printf 'machine \nlogin %s\npassword %s\n' \ + "$JIRA_EMAIL" "$JIRA_API_TOKEN" > ~/.config/gw-triage/netrc + chmod 600 ~/.config/gw-triage/netrc + + After writing, run the verification call. - `200` → tell the user (Italian) the existing credentials were migrated to the new store and work immediately; then do Step 3 (clean up legacy stores) and Step 4. Done — skip token creation. - - anything else → delete the netrc just written, tell them the old + - `401`/`403` → delete the netrc just written, tell them the old token no longer works, continue to Step 1. + - anything else (timeout, DNS) → network problem, not credentials: + report it (Italian) and stop, leaving the netrc in place — it may + verify fine later. 3. Nothing found → first-time setup, continue to Step 1. ## Step 1 — Token creation (user, in the browser) diff --git a/skills/triage/SKILL.md b/skills/triage/SKILL.md index 55fafa9..19259c4 100644 --- a/skills/triage/SKILL.md +++ b/skills/triage/SKILL.md @@ -66,8 +66,10 @@ with user text on the command line. --netrc-file ~/.config/gw-triage/netrc \ /rest/api/2/myself - Anything but `200` → STOP (Italian): token scaduto o revocato, - rilancia `$setup`. + - `401`/`403` → STOP (Italian): token scaduto o revocato, + rilancia `$setup`. + - anything else → STOP (Italian): problema di rete verso Jira, non + di credenziali — riprova più tardi. ## Step 1 — Input