Closed: wrong repository ownership - #77
Conversation
There was a problem hiding this comment.
Pull request overview
Clarifies the browser-backed device-code authentication flow in the public docs, explicitly guiding agents to source shared-account credentials from a private workspace vault and to keep credential material and private vault topology out of CLI inputs, logs, chat, and public documentation.
Changes:
- Add explicit guidance that
putio auth loginis browser-only for credentials (no username/password/OTP accepted by the CLI). - Document shared-account handling: retrieve credentials from a private workspace vault and enter them only in the browser.
- Reinforce operational hygiene: avoid leaking credentials, approval codes, and related sensitive details into commands/logs/chat/docs.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| skills/putio-cli/SKILL.md | Adds shared-account credential-handling guidance adjacent to the profile-based login flow. |
| skills/putio-cli/references/auth.md | Expands the auth reference with a step-by-step device-code flow plus explicit “don’t leak secrets” guidance. |
| README.md | Updates the top-level agent-facing authentication instructions to include private-vault sourcing and secrecy constraints. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| putio auth login --profile devs-fe-auto | ||
|
|
||
| Tell the human to open the printed URL, enter the printed code, and complete approval. After auth succeeds, select the named profile with: | ||
| Tell the human to open the printed URL. If the shared account is not already signed in, get its credentials from the owning workspace's private credential vault and enter them only in the browser. Enter the printed code and complete approval. Never put account credentials or private vault details in the CLI, prompt, logs, or public documentation. After auth succeeds, select the named profile with: |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: cf51f2ec7c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| the profile. | ||
|
|
||
| The CLI never accepts the account username, password, or one-time code. Do not | ||
| put credential values, private vault topology, approval codes, or approval URLs |
There was a problem hiding this comment.
When a user follows the auth approve workflow documented below, the supported invocation necessarily passes the device approval code as a positional argument (or in --json), so the blanket instruction not to put approval codes in commands directly contradicts the examples and makes that legitimate flow appear prohibited. Limit this warning to account credentials and vault details, or explain how approval codes should be handled safely in shell history.
Useful? React with 👍 / 👎.
| putio auth login --profile devs-fe-auto | ||
|
|
||
| Tell the human to open the printed URL, enter the printed code, and complete approval. After auth succeeds, select the named profile with: | ||
| Tell the human to open the printed URL. If the shared account is not already signed in, get its credentials from the owning workspace's private credential vault and enter them only in the browser. Enter the printed code and complete approval. Never put account credentials or private vault details in the CLI, prompt, logs, or public documentation. After auth succeeds, select the named profile with: |
There was a problem hiding this comment.
When PUTIO_CLI_WEB_APP_URL is overridden, the CLI accepts any absolute URL and prints a device-link URL on that origin, but this new prompt tells the human to enter shared-account credentials into the printed browser page without first verifying its host. A poisoned workspace environment or simple misconfiguration could therefore disclose the shared credentials to a non-put.io site; require verification of the expected trusted origin before credential entry.
Useful? React with 👍 / 👎.
altaywtf
changed the title
Summary
Closed without merge. This workflow belongs to a separate development owner and must not change the user-facing product guidance.
Verification
Not applicable.
Notes
No changes landed.