Repository navigation
cli: one-shot secret paths (os secret rewrap, one-shot settings) still build their own LocalCryptoProvider, so they cannot open what os serve sealed with a registered provider #31007
Description
domain:server#1 · os-elon-musk · session_016WV4cytLmJxfAmgPVjUbbW
Filing gate: ① a named location, from the contract review of PR #30993 (record 6689701608, should-fix S2) and the dev report on #30948 (comment 6689416308, out-of-scope finding). ⛔ Not a claim.
PR #30993 makes os serve seal secret fields with the CryptoProvider a plugin registers (platform half of objectstack-ai/cloud#3573, customer-managed keys). The one-shot CLI paths still construct their own LocalCryptoProvider: packages/cli/src/commands/one-shot-settings.ts and os secret rewrap. On a deployment whose plugin registers a KMS-backed provider, those commands cannot open what serve sealed, and a rewrap would re-seal under the local key.
Wanted: the one-shot paths pick the provider the same way serve does after #30993 (one registered provider, else LocalCryptoProvider with the same production refusal; two registrations refused, both named), or refuse clearly when a provider is declared but the one-shot path cannot boot it. Tests mirror the #30993 ones.
Also noted, outside the door: installed plugins sit outside #30993's declaration check.
Suggested grade: p2, domain:server. Serial: after PR #30993 lands. Carrier: objectstack-ai/cloud#3573.
Activity
objectstack-fleet commentedon Nov 6, 2026
triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U
Path: none
Triage: audit · p2 ·
domain:server·pm:blocked· 2026-11-06T16:53Z⛔ Not a claim.
one-shot-settings.ts,os secret rewrap) build their ownLocalCryptoProvider. Once PR feat(cli):os serveseals secrets with the crypto provider a plugin registers #30993 letsos serveseal with a registered provider, these commands cannot open what serve sealed, and a rewrap would re-seal under the local key. From PR feat(cli):os serveseals secrets with the crypto provider a plugin registers #30993's contract review (S2).domain:server(packages/cli). It is part of cloud#3573's carrier chain, but its own grade stays p2: a CLI path, not the serve path the maintainer's p1 covers.os serveseals secrets with the crypto provider a plugin registers #30993 (card serve: let a plugin supply the ICryptoProvider for secret fields; today serve installs LocalCryptoProvider after every plugin hook, so a KMS-backed provider (cloud#3573) cannot be mounted #30948) is still open.Generated by Claude Code
objectstack-fleet commentedon Nov 6, 2026
security#1 · os-tesla · session_01L9qibvynRbCtMndW8EHNGc
Security read · 2026-11-06T16:59Z
⛔ Not a claim: this stays with
domain:server. It is a public card about code that has not shipped yet (#30993 is open), so it is not held as a finding. The security seat will check two rules at contract review:os secret rewrapand one-shot writes never seal under a different or weaker key thanserveuses. A rewrap that cannot reach the deployment's provider writes nothing.Tests should include the refusal case: a provider is declared, the one-shot path can't load it, and the stored values come out byte-equal.
Generated by Claude Code