From 6ca8758f8f91e58d7a58615d95381fdc579d0343 Mon Sep 17 00:00:00 2001 From: be-coder-06 Date: Wed, 5 Aug 2026 13:21:03 -0500 Subject: [PATCH] fix(mosaic): derive credential resolution traces --- .../framework/tools/git/detect-platform.sh | 23 +++++++++++-------- .../framework/tools/git/git-credential-mosaic | 12 ++++++---- 2 files changed, 22 insertions(+), 13 deletions(-) diff --git a/packages/mosaic/framework/tools/git/detect-platform.sh b/packages/mosaic/framework/tools/git/detect-platform.sh index ff86ef84..5519bd29 100755 --- a/packages/mosaic/framework/tools/git/detect-platform.sh +++ b/packages/mosaic/framework/tools/git/detect-platform.sh @@ -501,15 +501,15 @@ get_gitea_url_for_host() { # Priority: Mosaic credential loader → GITEA_TOKEN env → ~/.git-credentials _trace_credential_resolution() { [[ "${MOSAIC_CREDENTIAL_TRACE:-}" == 1 ]] || return 0 - local resolution_path="$1" reason="$2" identity="$3" host="$4" source="$5" + local reason="$1" identity="$2" host="$3" source="$4" local shared_path_entered=false - [[ "$resolution_path" == shared ]] && shared_path_entered=true + [[ "$_resolution_path" == shared ]] && shared_path_entered=true printf 'MOSAIC_CREDENTIAL_RESOLUTION outcome=ok reason=%s identity=%s host=%s resolution_path=%s shared_path_entered=%s source=%s\n' \ - "$reason" "$identity" "$host" "$resolution_path" "$shared_path_entered" "$source" >&2 + "$reason" "$identity" "$host" "$_resolution_path" "$shared_path_entered" "$source" >&2 } get_gitea_token() { - local host="$1" + local host="$1" _resolution_path=unresolved local script_dir script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" local cred_loader="$script_dir/../_lib/credentials.sh" @@ -543,12 +543,14 @@ get_gitea_token() { local _resolved_token _resolved_token=$(python3 "$script_dir/resolve-credential-envelope.py" \ "$_idcred" "$_ident" "${MOSAIC_CREDENTIAL_ESTATE:-}" "$host") || return 1 - _trace_credential_resolution identity credential-resolved "$_ident" "$host" "$_ident_src" + _resolution_path=identity + _trace_credential_resolution credential-resolved "$_ident" "$host" "$_ident_src" printf '%s\n' "$_resolved_token" return 0 fi if [[ -r "$_idtok" ]]; then - _trace_credential_resolution identity credential-resolved "$_ident" "$host" "$_ident_src" + _resolution_path=identity + _trace_credential_resolution credential-resolved "$_ident" "$host" "$_ident_src" cat "$_idtok" return 0 fi @@ -604,7 +606,8 @@ get_gitea_token() { echo "${GITEA_TOKEN:-}" ) if [[ -n "$token" ]]; then - _trace_credential_resolution shared shared-credential-resolved '' "$host" credentials-loader + _resolution_path=shared + _trace_credential_resolution shared-credential-resolved '' "$host" credentials-loader echo "$token" return 0 fi @@ -613,7 +616,8 @@ get_gitea_token() { # 2. GITEA_TOKEN env var (only when GITEA_URL, if present, matches the remote host) if [[ -n "${GITEA_TOKEN:-}" ]]; then if [[ -z "${GITEA_URL:-}" ]] || gitea_url_matches_host "$GITEA_URL" "$host"; then - _trace_credential_resolution shared shared-credential-resolved '' "$host" environment + _resolution_path=shared + _trace_credential_resolution shared-credential-resolved '' "$host" environment echo "$GITEA_TOKEN" return 0 fi @@ -625,7 +629,8 @@ get_gitea_token() { local token token=$(grep -F "$host" "$creds" 2>/dev/null | sed -n 's#https\?://[^@]*:\([^@/]*\)@.*#\1#p' | head -n 1) if [[ -n "$token" ]]; then - _trace_credential_resolution shared shared-credential-resolved '' "$host" git-credentials + _resolution_path=shared + _trace_credential_resolution shared-credential-resolved '' "$host" git-credentials echo "$token" return 0 fi diff --git a/packages/mosaic/framework/tools/git/git-credential-mosaic b/packages/mosaic/framework/tools/git/git-credential-mosaic index 348ff3dd..a8cce2a9 100755 --- a/packages/mosaic/framework/tools/git/git-credential-mosaic +++ b/packages/mosaic/framework/tools/git/git-credential-mosaic @@ -27,12 +27,13 @@ done script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" trace_resolution() { [ "${MOSAIC_CREDENTIAL_TRACE:-}" = 1 ] || return 0 - resolution_path="$1" reason="$2" trace_identity="$3" trace_host="$4" source="$5" + reason="$1" trace_identity="$2" trace_host="$3" source="$4" shared_path_entered=false [ "$resolution_path" = shared ] && shared_path_entered=true printf 'MOSAIC_CREDENTIAL_RESOLUTION outcome=ok reason=%s identity=%s host=%s resolution_path=%s shared_path_entered=%s source=%s\n' \ "$reason" "$trace_identity" "$trace_host" "$resolution_path" "$shared_path_entered" "$source" >&2 } +resolution_path=unresolved # Per-agent identity resolution (Gate-16 author≠reviewer separation). # Priority: MOSAIC_GIT_IDENTITY env > git config mosaic.gitIdentity (per-worktree, # survives across non-persistent shells) > git-supplied username (credential.username @@ -59,13 +60,15 @@ if [ -n "$ident" ]; then if [ -e "$idcred" ] || [ -L "$idcred" ]; then token=$(python3 "$script_dir/resolve-credential-envelope.py" \ "$idcred" "$ident" "${MOSAIC_CREDENTIAL_ESTATE:-}" "$host") || exit 1 - trace_resolution identity credential-resolved "$ident" "$host" git-credential-mosaic + resolution_path=identity + trace_resolution credential-resolved "$ident" "$host" git-credential-mosaic echo "username=${ident}" echo "password=${token}" exit 0 fi if [ -r "$idtok" ]; then - trace_resolution identity credential-resolved "$ident" "$host" git-credential-mosaic + resolution_path=identity + trace_resolution credential-resolved "$ident" "$host" git-credential-mosaic echo "username=${ident}" echo "password=$(cat "$idtok")" exit 0 @@ -98,7 +101,8 @@ esac # shellcheck source=../_lib/credentials.sh source "$script_dir/../_lib/credentials.sh" load_credentials "$svc" >/dev/null 2>&1 || exit 0 -trace_resolution shared shared-credential-resolved '' "$host" credentials-loader +resolution_path=shared +trace_resolution shared-credential-resolved '' "$host" credentials-loader # GITEA_USER is not populated by load_credentials (it only exports # GITEA_URL/GITEA_TOKEN for gitea-*), so this fallback is normally taken. Gitea's # git-over-HTTP auth authenticates from the token itself (the password field),