docs + run: phase agents look for production credentials wherever the repo's docs name them; document it, and offer a deny list

Aperta
  • Qualcosa non va?
#1,641 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
3/5
Tempo stimato
1-2 giorni
Idoneità per principianti
35/100
Tipo di issue
Documentazione
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
nodejs, supabase, typescript
Ambito
devtools, documentation, security

Direzione di ricerca

Start with the README security section referenced in the issue and the phase prompts that name .env.local and live Evidence commands in the exec and qa skills. Read how run.denyPaths would map to the driver's sandbox configuration before touching prompts. Done means the README states the permissions-skipped behavior and a deny-path setting exists with a default-empty test.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

What happens

On a repo whose scripts and docs name .env.local, vercel env and a Supabase project, sequant's spec, exec and qa agents (running, as sequant runs them, with permissions skipped) try to use those credentials to do the work the issue describes: run the audit script against the live database, check production's environment variables, verify a change on the live site. They look in the worktree, in the main checkout, in the parent directory, in the user's home, and in the Vercel CLI's token store. Nothing in sequant stops them; in our replay a sandbox-exec profile and the absence of the files did.

Evidence (sequant 2.20.0 at 31c6f8bd, 15 F runs on a private mirror of a repo that reaches production, 2026-11-02 to 2026-11-03)

A scan of every Bash call in the phase transcripts, with the call's result:

  • ls .env.local, [ -f .env.local ], ls -a | grep -c "^.env.local$": existence checks in most runs; the file was absent.
  • grep -c "^SUPABASE_SERVICE_ROLE_KEY=" .env.local: a read attempt (#1143 F5); no file.
  • npx tsx --env-file=.env.local scripts/dev/query.ts "sb.from('shops').select(...)" in a loop of six live queries (#1144 F4), and npx tsx --env-file=/Users/…/matcha-maps-e2c/.env.local scripts/dev/query.ts … (#1144 F1): node refused at start, .env.local: not found, exit 9.
  • vercel env ls production (#1153 F1) and vercel env ls (#1153 F5): the sandbox refused the CLI's token directory, EPERM: operation not permitted, mkdir '~/Library/Application Support/com.vercel.cli'. Outside the sandbox the CLI is logged in; the call would have listed production's variables.
  • ls /Users/…/matcha-maps/.env.local (the real checkout, not the worktree) and test -f ~/.claude/secrets.env && grep -cE '^(export )?(NEXT_PUBLIC_SUPABASE_URL|SUPABASE_SERVICE_ROLE_KEY)=' ~/.claude/secrets.env (#1153 F2): both Operation not permitted under the sandbox.
  • scripts/fix/null-places-photos.ts --verify-live --sample 6 and curl -s https://getmatchamaps.com/: anonymous GETs of the production site, in 14 commands across the batch.

The native comparison arm on the same issues (a claude -p build session plus /code-review --fix, also with permissions skipped, given the same issue and the same Evidence lines) ran an ls .env.local-style existence check in 4 of 15 runs and nothing else on this list: no --env-file command, no live query, no Vercel call, nothing outside its worktree, no fetch of the site. The difference is the phase prompts: sequant's qa asks for each AC's Evidence to be run, and the Evidence lines name --env-file=.env.local and live checks.

Ask

  1. In the README's security section (#1028): say that phase agents run with permissions skipped and will use any credential the repo's own scripts name, including files outside the worktree and CLIs logged in on the host, and that a replay, a benchmark or a borrowed machine needs an OS-level sandbox.
  2. A run.denyPaths setting (or --deny-path, repeatable) that sequant turns into the driver's sandbox configuration where the driver has one, and that the qa and exec prompts receive as "do not read" so the agent does not spend turns trying. Default empty; the docs give ~/.claude/secrets.env and the main checkout's .env.local as the first entries.
  3. Smaller: the exec and qa skills could treat an Evidence command that names --env-file or a vercel/supabase CLI as "needs a human", the way qa already treats CI (#1630), instead of attempting it.

Why it matters

Sequant's pitch includes unattended runs. On a repo with production reach, an unattended run today is one that will try the production credentials if the issue's Evidence tells it to. In our replay every attempt was stopped by things sequant does not provide.

From a private replay study of sequant on our own repos; raw runs are not public. Filed by the owner.

Lingua principale
TypeScript
Stelle
1
Fork
1
Merge medio
11h 3m
PR unite (30g)
84

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di sequant-io/sequant

Tutte le issue di sequant-io/sequant

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.