Repository navigation

Installer: no secret on a command line (bootstrap env, GitHub/Cloudflare tokens) with a census (o3d-kb3dq) - #762

Merged

OneTwo3D merged 17 commits into

developmentfrom

o3d-installer-secrets-argv

Oct 16, 2026

Merged

Installer: no secret on a command line (bootstrap env, GitHub/Cloudflare tokens) with a census (o3d-kb3dq)#762
OneTwo3D merged 17 commits into
developmentfrom
o3d-installer-secrets-argv

Commits on Oct 9, 2026
- Installer: no secret on a command line (bootstrap env, GitHub and Cloudflare tokens) with a census
  
  OneTwo3D
  and
  claude
  committed
  6106cb6
- Installer: bootstrap exports through a function so the exit status is captured where the deploy-order guard reads it
  
  OneTwo3D
  and
  claude
  committed
  fe3aede
- Cron jobs: the bearer leaves curl's command line (installer and in-app scheduler), fail closed; census scans rendered output
  
  OneTwo3D
  and
  claude
  committed
  d9007b1
- Merge origin/development into o3d-installer-secrets-argv
  OneTwo3D
  committed
  a86353d
- Cron jobs: align the installer cron-secret test and the test env type with the stdin form
  
  OneTwo3D
  and
  claude
  committed
  e864168
Commits on Oct 10, 2026
- Installer: rewrite legacy cron -H bearer lines in an existing managed block (verified, refuse otherwise); wider argv census rules
  
  OneTwo3D
  and
  claude
  committed
  1afaaa1
- Merge origin/development into o3d-installer-secrets-argv
  OneTwo3D
  committed
  e5f1559
- Census canary: no literal user:pass at rest; gitleaks fingerprint for the earlier commit's sample
  
  OneTwo3D
  and
  claude
  committed
  3cf2a26
Commits on Oct 15, 2026
- Installer: rewrite legacy cron bearer lines from update.sh and deploy.sh too; render job lines without pattern replacement
  
  OneTwo3D
  and
  claude
  committed
  9887a56
- Cron rewrite: roster the new locked bodies in the guards; template without bare $NAME
  
  OneTwo3D
  and
  claude
  committed
  15f8e98
- Cron rewrite: unmarked historical jobs and a general bearer-header detector
  
  OneTwo3D
  and
  claude
  committed
  f592b26
- docs: unmarked historical cron jobs and the general bearer-header refusal
  
  OneTwo3D
  and
  claude
  committed
  3abd7b4
- Merge remote-tracking branch 'origin/development' into o3d-installer-secrets-argv
  OneTwo3D
  committed
  7ba31c4
- Cron rewrite: keep the historical-shape regex free of a command-substitution lookalike; install-cron-secret ignores comments
  
  OneTwo3D
  and
  claude
  committed
  c22e1d8
- Tests: build the unrecognised-bearer canary lines by concatenation; gitleaks fingerprints for the previous commit's two samples
  
  OneTwo3D
  and
  claude
  committed
  ed9b2b9
Commits on Oct 16, 2026
- First rollout: document running the release's own scripts (the predecessor driver cannot run the new rewrite), with a numbers-only check; simulate it
  
  OneTwo3D
  and
  claude
  committed
  9f307f5
- Merge remote-tracking branch 'origin/development' into o3d-installer-secrets-argv
  OneTwo3D
  committed
  41ca6cf

Commits

Commits on Oct 9, 2026

Commits on Oct 10, 2026

Commits on Oct 15, 2026

Commits on Oct 16, 2026