Repository navigation
Conversation
… tool's arguments The shared `sensitive` description told agents to mark every typed secret sensitive and to reach other tools through "that tool's own credential-reference flow". Warehouse task agents read that as a ban on secrets in tool arguments and ended blocked after the user had typed a credential. The description now limits `sensitive` to secrets bound for .env and says a credential for another tool is a plain answer passed in that tool's arguments. Co-Authored-By: Claude Opus 5.5 <[email protected]> Generated-By: PostHog Desktop Task-Id: e2ce3d5f-ccfa-48b2-b0ad-2e364190e91c
🧙 Wizard CIRun the Wizard CI and test your changes against wizard-workbench example apps by replying with a GitHub comment using one of the following commands: Test all apps:
Test all apps in a directory:
Test an individual app:
Show more apps
Test against a Context Mill branch:
Add Results will be posted here when complete. |
![veria-ai[bot]](https://avatars.githubusercontent.com/in/1723776?s=60&v=4){kind=small}
PR overviewAll previously flagged issues have been addressed. No open security concerns remain on this pull request. Security reviewNo open security issues remain on this pull request. Fixed/addressed: 1 · PR risk: 0/10 |
johncwaters
left a comment
johncwaters
left a comment
There was a problem hiding this comment.
Note
Automated review. Not written by a human.
| 'instead of the raw string. Set it only for a secret whose one destination ' + | ||
| 'is a .env file: set_env_values resolves the secretRef, and no other tool ' + | ||
| 'does — the PostHog data-warehouse tools and every other MCP tool reject it. ' + | ||
| 'A credential you must hand to another tool, such as a data-warehouse ' + |
There was a problem hiding this comment.
Note
Automated review. Not written by a human.
[security] HIGH
Telling the agent to collect a warehouse credential with sensitive unset means the terminal prompt does not mask it: shouldMaskAnswer in src/tui/screens/WizardAskScreen.tsx masks only when sensitive === true. The password or API key is echoed on screen (the leak that function's comment describes) and enters the model conversation. Keep masking for this case, or note that unmasked echo is accepted.
| 'source credential, is collected with sensitive unset and passed in that ' + | ||
| "tool's arguments exactly as the user typed it. That is the intended path: " + | ||
| 'the user typed it for that purpose, so do not withhold it or swap in a ' + | ||
| 'browser or credential-reference flow instead.'; |
There was a problem hiding this comment.
Note
Automated review. Not written by a human.
[code-review] LOW
This description is shared by every wizard_ask caller. "do not withhold it" could push the agent to pass a typed secret as plain text to any tool. Narrow the wording to the PostHog source-setup tools.
Problem
The seeded warehouse task collects source credentials with
wizard_askand hands them to the PostHog source-setup tool. More and more of these task agents end the task asnot needed/blockedeven after the user typed the credential. Their remarks give the reason: they say a runtime rule forbids secrets in tool arguments except the wizard's env tools, and that a "credential-reference flow" should be used instead. The rate has been climbing daily since mid-October across several wizard versions, and completions have fallen as it rose.That rule comes from the wizard's own shared
sensitivefield description. It says to usesensitivefor "any other secret the user types in", and to reach any other tool by writing the secret to.envor through "that tool's own credential-reference flow". The context-mill warehouse skill says the opposite: collect plaintextanswers and pass them to the PostHog tool.Why: A user who types a database password or API key into the terminal and then gets no source is the most costly way this flow can fail. This fixes the part of the completion drop where the work is actually lost. It does not cover the part caused by the consent notice moving to the end of the run.
Changes
WIZARD_ASK_SENSITIVE_DESCRIPTION, shared by the pi and MCPwizard_askschemas, now limitssensitiveto secrets that go only to a.envfile. It says that a credential for another tool, such as a data-warehouse source, is collected withsensitiveunset and passed in that tool's arguments as typed, without being replaced by a browser or credential-reference flow.Watch for the effect in the warehouse task's skip events (
not_needed_reason = blocked) and in itsorchestrator remarkevents. Both should fall, andorchestrator task completedfortype = warehouseshould rise.Test plan
pnpm build,pnpm typecheck, andvitest run src/agent(1130 passed)Created with PostHog Desktop
🤖 Generated with Claude Code