singularity/singularity-forge
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

fix: re-check secrets manifest before every dispatch, not just at startAuto

Browse source 
When plan-milestone writes SECRETS-MANIFEST.md, the secrets gate at
startAuto has already fired (manifest didn't exist yet). Without a
re-check, the model proceeds into plan-slice / execute-task with no
real credentials and mocks external services — cascading risk into
every downstream slice.

Added a secrets re-check gate inside dispatchNextUnit that runs before
every unit dispatch. getManifestStatus is cheap (file read + .env
scan) so the check is a no-op when no manifest exists or all secrets
are already collected. Idempotent: skips keys already present in .env.

Closes #303
This commit is contained in:
Lex Christopherson 2026-03-13 23:07:01 -06:00
parent 63e30e842d
commit 2b96b1a247
1 changed files with 21 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

21
src/resources/extensions/gsd/auto.ts
View file

@ -1176,6 +1176,27 @@ async function dispatchNextUnit(
}
}
// ── Secrets re-check gate — runs before every dispatch, not just at startAuto ──
// plan-milestone writes SECRETS-MANIFEST.md during its unit. By the time we
// reach the next dispatchNextUnit call the manifest exists but hasn't been
// presented to the user yet. Without this re-check the model would proceed
// into plan-slice / execute-task with no real credentials and mock everything.
try {
const manifestStatus = await getManifestStatus(basePath, mid);
if (manifestStatus && manifestStatus.pending.length > 0) {
const result = await collectSecretsFromManifest(basePath, mid, ctx);
ctx.ui.notify(
`Secrets collected: ${result.applied.length} applied, ${result.skipped.length} skipped, ${result.existingSkipped.length} already set.`,
"info",
);
}
} catch (err) {
ctx.ui.notify(
`Secrets collection error: ${err instanceof Error ? err.message : String(err)}`,
"warning",
);
}
const needsRunUat = await checkNeedsRunUat(basePath, mid, state, prefs);
// Flag: for human/mixed UAT, pause auto-mode after the prompt is sent so the user
// can perform the UAT manually. On next resume, result file will exist → skip.