Renn F bb94e6baf8 [F063] workspace._clone_repo: rmtree half-configured clone on failure ...

If _configure_git raised CalledProcessError before its `remote set-url`
scrub, .git/config kept the tokenized auth URL (the project PAT) and
_assert_no_pat_leak never ran. The except clauses raised WorkspaceError
without removing the workspace, so the next ensure_workspace's health
short-circuit (valid .git with HEAD + objects) skipped past the leak —
mounting the agent on a workspace whose .git/config let it read+exfiltrate
the PAT. Both clone-failure except clauses now rmtree the workspace before
raising, so a half-configured clone is destroyed and ensure_workspace
re-clones from scratch. TDD: 2 tests (configure-failure leak + timeout).

2026-06-28 17:05:36 +02:00

..

fixtures

Feature: lifecycle canonical spec (#14)

2026-05-11 02:15:47 +02:00

foundation

[F043] guard escalate_up against resurrecting terminal tasks

2026-06-28 11:28:23 +02:00

integration

[chore] remove all remaining type:ignore suppressions from tests/

2026-06-28 17:00:20 +02:00

property

Chore: reduce analytics complexity (#100)

2026-06-11 04:36:17 +02:00

unit

[F063] workspace._clone_repo: rmtree half-configured clone on failure

2026-06-28 17:05:36 +02:00

__init__.py

[beb8cae1] Type-gate tests/ under mypy — fix all errors and flip quality gate (#156) (#157)

2026-06-14 13:43:46 +02:00

conftest.py

[F059] fix DB-integration test auth + retype self-heal root code→planning

2026-06-28 16:21:46 +02:00