Skip to content

Closed: wrong repository ownership #77

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
altaywtf wants to merge 1 commit into from
Closed

Closed: wrong repository ownership #77

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,7 +79,7 @@ putio auth status --profile devs-fe-auto --output json
If auth is missing, start login with:
putio auth login --profile devs-fe-auto

Tell the human to open the printed URL, enter the printed code, and complete approval. After auth succeeds, select the named profile with:
Tell the human to open the printed URL. If the shared account is not already signed in, get its credentials from the owning workspace's private credential vault and enter them only in the browser. Enter the printed code and complete approval. Never put account credentials or private vault details in the CLI, prompt, logs, or public documentation. After auth succeeds, select the named profile with:

@chatgpt-codex-connector chatgpt-codex-connector Bot Aug 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Verify the browser origin before entering shared credentials

When PUTIO_CLI_WEB_APP_URL is overridden, the CLI accepts any absolute URL and prints a device-link URL on that origin, but this new prompt tells the human to enter shared-account credentials into the printed browser page without first verifying its host. A poisoned workspace environment or simple misconfiguration could therefore disclose the shared credentials to a non-put.io site; require verification of the expected trusted origin before credential entry.

Useful? React with 👍 / 👎.

putio auth profiles use devs-fe-auto

After that, continue with the requested task instead of stopping after setup.
Expand Down Expand Up @@ -114,6 +114,9 @@ putio auth profiles use devs-fe-auto

The CLI does not accept put.io account credentials. Its login flow delegates authorization to the
configured web app (`app.put.io` by default) and stores only the returned OAuth token.
For a shared account, get its credentials from the owning workspace's private credential vault and
enter them only in that browser flow. Keep credential values and private vault topology out of the
CLI, logs, chat, and public documentation.

Check the auth source:

Expand Down
7 changes: 7 additions & 0 deletions skills/putio-cli/SKILL.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,6 +55,13 @@ putio auth login --profile devs-fe-auto
putio auth profiles use devs-fe-auto
```

`putio auth login` delegates account authentication to the browser; it never
accepts the account username, password, or one-time code. For a shared account,
get those credentials from the owning workspace's private credential vault and
enter them only in the browser before approving the CLI's device code. Keep
credential values and private vault topology out of commands, logs, chat, and
public documentation.

Use `PUTIO_CLI_PROFILE=devs-fe-auto` when a harness should select that profile without repeating `--profile`. Use `PUTIO_CLI_TOKEN` only when headless token auth is the better fit; it overrides selected and persisted profiles.

Manage persisted profiles explicitly:
Expand Down
15 changes: 15 additions & 0 deletions skills/putio-cli/references/auth.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,21 @@ putio auth login --profile devs-fe-auto
putio auth profiles use devs-fe-auto
```

The named-profile login is a browser-backed device-code flow:

1. Run `putio auth login --profile devs-fe-auto` and keep the process running.
2. Open the printed URL in a browser.
3. If the shared account is not already signed in, get its credentials from
the owning workspace's private credential vault and enter them only in the
browser.
4. Enter and approve the CLI's printed device code.
5. Let the CLI finish storing the returned OAuth token, then select and verify
the profile.

The CLI never accepts the account username, password, or one-time code. Do not
put credential values, private vault topology, approval codes, or approval URLs

@chatgpt-codex-connector chatgpt-codex-connector Bot Aug 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Permit approval codes in documented CLI commands

When a user follows the auth approve workflow documented below, the supported invocation necessarily passes the device approval code as a positional argument (or in --json), so the blanket instruction not to put approval codes in commands directly contradicts the examples and makes that legitimate flow appear prohibited. Limit this warning to account credentials and vault details, or explain how approval codes should be handled safely in shell history.

Useful? React with 👍 / 👎.

in commands, logs, chat, or public documentation.

For interactive login:

```bash
Expand Down