fix(inference): a credential must not survive in an endpoint, a name, or a log - #2281

Merged

graycyrus merged 28 commits into

tinyhumansai:mainfrom

graycyrus:fix/inference-credential-safety

Sep 14, 2026

Commits on Sep 11, 2026

fix(store): a legacy secret path too long to exist reads as absent
graycyrus
committed
32abd5b
feat(inference): bound the provider name, and refuse an endpoint that carries a credential
graycyrus
committed
69928fc
fix(inference): redact credentials embedded in provider endpoints
graycyrus
committed
dae7078
test(inference): prove the credential-in-endpoint invariant on every path
graycyrus
committed
d94a862
docs(inference): record the endpoint-credential rule beside the four slots
graycyrus
committed
91ffd30
fix(harness): redact the endpoint in the model-unavailable advice
graycyrus
committed
f11942f
fix(setup): redact the house endpoint the first-run status reports
graycyrus
committed
bd96c60

Commits on Sep 14, 2026

Merge remote-tracking branch 'upstream/main' into fix/inference-credential-safety
graycyrus
committed
798d587
Merge remote-tracking branch 'upstream/main' into fix/inference-credential-safety
graycyrus
committed
bb02255
fix(inference): redact the endpoint in the catalogue cache's own failures and the scoped-catalogue fallback warning
graycyrus
committed
995882e
fix(setup): refuse a credentialed endpoint in the first-run probe before sending anything, and redact what it echoes
graycyrus
committed
67ee2bf
fix(console): clamp the provider name in code points, not maxLength's UTF-16 units
graycyrus
committed
f756e75
fix(inference): a second or uppercase scheme must not hide an endpoint's credential
graycyrus
committed
1f0dc31
fix(console): find an endpoint credential behind a second scheme, as the host does
graycyrus
committed
54263fa
fix(inference): read a malformed endpoint conservatively, so no shape of URL hides its credential
graycyrus
committed
fa90ef4
fix(console): read a malformed endpoint conservatively, as the host does
graycyrus
committed
64358c8
test(inference): credentials in two authorities are both redacted
graycyrus
committed
f195130
fix(inference): find a credential in every authority an HTTP client could read, and no further
graycyrus
committed
9ebd4fc
fix(console): find an endpoint credential in every readable authority, as the host does
graycyrus
committed
feeff4a
fix(inference): refuse only the userinfo a client reads, and redact wider than that
graycyrus
committed
8fffc19
fix(console): read endpoint credentials as a client does, and clamp the trimmed name
graycyrus
committed
18965c4
fix(inference): see through the whitespace a URL parser drops, and keep a served endpoint posted back on an edit
graycyrus
committed
8e55441
fix(console): see through URL-parser whitespace, and send no endpoint on an edit that did not change it
graycyrus
committed
51fcd25
test(inference): import the provider store in the rename test, which did not compile
graycyrus
committed
9a5c8cd
fix(inference): read a single-slash scheme as a scheme, and hop only past a doubled one
graycyrus
committed
e97d5ba
fix(inference): scrub the Basic credential an endpoint carried from a logged probe body
graycyrus
committed
8ed8fc1
fix(console): a bare scheme with one slash is a host, not a second scheme
graycyrus
committed
52b5c15
fix(inference): a username with no password is the credential, and is scrubbed from a logged probe body
graycyrus
committed
7b580e8

Navigation Menu

fix(inference): a credential must not survive in an endpoint, a name, or a log - #2281

fix(inference): a credential must not survive in an endpoint, a name, or a log#2281
graycyrus merged 28 commits into
tinyhumansai:mainfrom
graycyrus:fix/inference-credential-safety

Commits on Sep 11, 2026

fix(store): a legacy secret path too long to exist reads as absent

feat(inference): bound the provider name, and refuse an endpoint that carries a credential

fix(inference): redact credentials embedded in provider endpoints

test(inference): prove the credential-in-endpoint invariant on every path

docs(inference): record the endpoint-credential rule beside the four slots

fix(harness): redact the endpoint in the model-unavailable advice

fix(setup): redact the house endpoint the first-run status reports

Commits on Sep 14, 2026

Merge remote-tracking branch 'upstream/main' into fix/inference-credential-safety

Merge remote-tracking branch 'upstream/main' into fix/inference-credential-safety

fix(inference): redact the endpoint in the catalogue cache's own failures and the scoped-catalogue fallback warning

fix(setup): refuse a credentialed endpoint in the first-run probe before sending anything, and redact what it echoes

fix(console): clamp the provider name in code points, not maxLength's UTF-16 units

fix(inference): a second or uppercase scheme must not hide an endpoint's credential

fix(console): find an endpoint credential behind a second scheme, as the host does

fix(inference): read a malformed endpoint conservatively, so no shape of URL hides its credential

fix(console): read a malformed endpoint conservatively, as the host does

test(inference): credentials in two authorities are both redacted

fix(inference): find a credential in every authority an HTTP client could read, and no further

fix(console): find an endpoint credential in every readable authority, as the host does

fix(inference): refuse only the userinfo a client reads, and redact wider than that

fix(console): read endpoint credentials as a client does, and clamp the trimmed name

fix(inference): see through the whitespace a URL parser drops, and keep a served endpoint posted back on an edit

fix(console): see through URL-parser whitespace, and send no endpoint on an edit that did not change it

test(inference): import the provider store in the rename test, which did not compile

fix(inference): read a single-slash scheme as a scheme, and hop only past a doubled one

fix(inference): scrub the Basic credential an endpoint carried from a logged probe body

fix(console): a bare scheme with one slash is a host, not a second scheme

fix(inference): a username with no password is the credential, and is scrubbed from a logged probe body