Repository navigation
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![vercel[bot]](https://avatars.githubusercontent.com/in/8329?s=60&v=4){kind=small}
…o/managed-credentials-14-creation-context
…o/managed-credentials-14-creation-context
|
Automated agent reply (not from Jack). The initial Publish run and its one retry failed because the mock package did not re-export the new SDK constants. This is introduced by the stack, not a known default-branch failure: the matching export test passes at main f2ef3eb and fails at the initial layer-01 revision. The mock now re-exports the constants and types. Validation: a specific export regression failed before the fix and now passes. SDK: 452 passed, 83 skipped. Mock: 238 passed, 88 skipped. Final CLI: 639 passed. All layer heads passed isolated build/typecheck and full CLI tests. CI is pending or still being monitored for the new head |
…o/managed-credentials-14-creation-context
…o/managed-credentials-14-creation-context
…o/managed-credentials-14-creation-context
…o/managed-credentials-14-creation-context
scubbo
changed the title
scubbo
changed the title
|
Automated agent update (not from Jack). Closing this PR so we can simplify and shorten the managed-credentials CLI implementation before requesting human review again. We will consolidate the current work into one draft PR and use it as the simplification workspace. The existing branch and review history are preserved. A follow-up comment will link the replacement draft. |
|
Automated agent update (not from Jack). Replacement draft: #449 That single draft contains the current managed-credentials CLI implementation and will be used to simplify and shorten the change before human review. This closed PR remains historical context. Its branch and review history are preserved. The replacement is a draft, not ready for approval or merge. |
Automated implementation split from #419 for focused human review.
API-aligned terminology and publication status
Automated terminology update (not from Jack).
The title and scope summary use the agreed API-shaped model. The API-conformance follow-up remains local, uncommitted, and unpushed at the stack tip. This edit changes PR metadata only, not the published code or branch bases. Earlier implementation notes and test results below describe their recorded commits, not proof that the follow-up is published.
A source selects the initial checkout through
source.type: "git"andsource.url. Each group incredentials.githubcontainsrepositories,actions, and optionalactAs. Git and GitHub API actions share that list. File input, SDK requests, persistence, and replay use these same managed-credential fields without translation or regrouping. CLI-onlyrepoJSON keys are rejected. Team, project, resources, and other creation controls remain outside this credential document.Use GitHub actor for the account selected by
actAs. Normal commit credit comes from that same actor, not a separate local Git identity. Both review rows useinferred from active gh accountwhen gh selects the actor.commitAsremains a deprecated explicit override with safety checks.Project Bounds limit the project's maximum access. They do not grant a Sandbox every right in that limit. An unreadable policy stops creation. No Bounds are created or expanded by this workflow.
The API-aligned create action list excludes
git:read. Unsupported read intent is rejected, never converted to write access. Explicit action flags replace the full default set. They do not acquire hidden Git permissions.Review scope
Prepare the approved API-shaped managed-credential request from parsing, inference, review, and file input. Validate files before authentication. Preserve scope, source options, exact credential groups, and resource controls. Keep dry-run read-only and stop when the project Bounds cannot be read.
This is layer 14/17. Review the diff against the PR base, not against main. Each layer includes its owning tests and a changeset. Earlier layers do not enable the command surface. There are no dependency additions.
Stack
Base: #432. The next layer targets this branch. Merge in sequence after review, not as one combined change.
Validation
Isolated clean-worktree validation at
79f586273dc5e86aa7fffeb784152db421d80f8d: CLI build, typecheck and full tests passed. Focus: creation-context parser regressions plus prior flow/resolution suites.Test summary: 581 passed (581).
The first layer also passed SDK build, typecheck and the full SDK suite. Network/provider behavior is mocked. No production policy, Sandbox or flag was changed.
Deliberate limits
Legacy CLI credential flags and legacy configuration normalization are not carried forward. Deployed SDK/API compatibility is separate and retained.
Backend capability and rollout remain separate from CLI terminology. The agreed creation contract excludes
git:read. Unsupported access must stop instead of gaining write permissions. Project Bounds reads require authorization. An unreadable policy is not treated as having no Bounds. This workflow does not provision or expand project Bounds.Backend handoff: https://github.com/vercel/api/blob/scubbo/managed-credentials-api-devbox-context/_doc/managed-credentials-devbox-context.md
Navigation: previous #432; next #434. Full stack index.
Latest validation:
60638a7e5d780d5ff43a43d89a2830f70a57ad75passed isolated CLI build, typecheck and all tests after the automated review/CI fixes. Ancestor fixes are propagated by merges, not force pushes. The SDK/mock export parity failure is fixed in layer 01; owning review findings are fixed in their own layers. See the current checks and full stack index for remote CI outcomes.Guess correction follow-up
Automated implementation update (not from Jack).
Melkey suggested printing the full explicit-flags command after a user rejects an inferred proposal. Discussion.
Capture the original create/run/sh invocation and render the latest rejected proposal with explicit scope, resources, repository, actions, commit credit, and GitHub actor. Preserve shell arguments and read-only permissions. Replace token, environment, and request-header values with required environment-variable placeholders. Configurations that direct flags cannot express use resolved JSON and a printed private temporary-file command. Rendering creates no files and adds no approval.
Validation at
65d47ba3f1a4e92c5617f4f7e5b2a9d9073d3fe8: 660 CLI tests passed, including 56 command-rendering tests and real Bash/Zsh replay checks. CLI typecheck and build passed. The integration regressions failed before wiring the renderer. Remote CI and automated reviews are monitored separately.GitHub namespace, Bounds consent, and access presets
Automated implementation update (not from Jack).
Read Bounds presence with GET-only project/team resolution and complete team-wide pagination. Verify the final corrected scope, reject default-team substitution, and fail on unreadable policy. No Bounds are provisioned or changed.
The granular flags use
--credentials-github-*. The access preset layer owns--github-access. In the API-aligned follow-up,writeselectsgit:writeplus the 11 supported GitHub API actions.readand--credentials-github-no-writestop because create does not acceptgit:read. No preset adds workflow-file write access. See the publication status above before comparing this description with the published code.The stack retains Melkey's suggested explicit-command recovery after rejection. Discussion. Existing attribution and review history above are retained.
Current head:
82a3f722f94a9279576c0a1b410c80e4f408a09d. Local validation: Test Files 53 passed (53); Tests 830 passed (830). CLI build and typecheck passed; namespace-only comment follow-ups were checked separately.Inherited fix: preserve the requested JSON mode when project Bounds reads fail. The policy remains unknown and creation stops. The two new regressions failed before the fix, then passed. Fix commit:
82a3f722f94a9279576c0a1b410c80e4f408a09d.Saved-login preview in the final layer
Automated implementation update (not from Jack).
PR #440 adds the follow-up for
create --enable-github-credentials --dry-run. The final layer reuses saved Vercel login to discover an existing default team/project with read-only API calls. It does not refresh tokens or create a missing project. That follow-up also applies the final enable-flag name in help, examples, diagnostics, and rejected-command recovery. This note does not expand this layer's code scope. Existing Melkey attribution and review history are retained.Final consent behavior
Automated implementation update (not from Jack).
PR #440 supersedes the initial interactive-edit design with Create this sandbox? (y/n). Rejection prints the exact explicit-flags command for corrections in a new invocation. The final layer removes menus, re-resolution callbacks, and scope overrides. The separate no-Bounds confirmation, --yes warning, dry-run, and noninteractive rules remain. Earlier editing descriptions above are historical, not the final command surface. Human history and Melkey attribution are preserved.