Repository navigation
feat: OpenCode V2 agents, terminal polish, and client UX - #48
Conversation
Migrate agent HTTP to /api/* with Basic auth and credentials, add AI overlay and clipboard helpers, snippet drag-reorder, optional pinch-to-zoom, and hide duplicate mobile shortcut chips while connected. Co-authored-by: Cursor <cursoragent@cursor.com>
|
|
| GitGuardian id | GitGuardian status | Secret | Commit | Filename | |
|---|---|---|---|---|---|
| 39079844 | Triggered | Generic Password | cb0324e | test/models/ssh_profile_agent_auth_test.dart | View secret |
| 39079844 | Triggered | Generic Password | cb0324e | test/models/ssh_profile_agent_auth_test.dart | View secret |
| 39079844 | Triggered | Generic Password | cb0324e | test/models/ssh_profile_agent_auth_test.dart | View secret |
🛠 Guidelines to remediate hardcoded secrets
- Understand the implications of revoking this secret by investigating where it is used in your code.
- Replace and store your secrets safely. Learn here the best practices.
- Revoke and rotate these secrets.
- If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.
To avoid such incidents in the future consider
- following these best practices for managing and storing secrets including API keys and other credentials
- install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.
🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.
|
Sorry @involvex, your pull request is larger than the review limit of 150,000 diff characters |
![kilo-code-bot[bot]](https://avatars.githubusercontent.com/in/2193792?s=60&v=4){kind=small}
| username: profile.effectiveAgentUsername, | ||
| password: profile.effectiveAgentPassword, | ||
| // LAN OpenCode HTTPS is commonly self-signed. | ||
| allowInsecureTls: profile.useHttps, |
There was a problem hiding this comment.
CRITICAL: Module security - allowInsecureTls: profile.useHttps disables TLS certificate validation for every HTTPS profile, not just self-signed hosts. This makes the client vulnerable to MITM whenever HTTPS is used.
| allowInsecureTls: profile.useHttps, | |
| allowInsecureTls: profile.allowSelfSignedCerts, |
| _dio.httpClientAdapter = IOHttpClientAdapter( | ||
| createHttpClient: () { | ||
| final client = HttpClient(); | ||
| client.badCertificateCallback = |
There was a problem hiding this comment.
CRITICAL: Module security - badCertificateCallback unconditionally returns true, accepting any (including attacker-presented) certificate. Restrict this to explicitly trusted self-signed hosts or remove insecure TLS support.
| name: 'win', | ||
| host: 'h', | ||
| username: 'Lukas', | ||
| password: 'ssh-pass', |
There was a problem hiding this comment.
WARNING: Leaked secret - hardcoded password literal in test fixture ('ssh-pass'). GitGuardian flagged this as a generic password. Replace with a clearly fake placeholder or load from env.
| name: 'win', | ||
| host: 'h', | ||
| username: 'Lukas', | ||
| password: 'ssh-pass', |
There was a problem hiding this comment.
WARNING: Leaked secret - hardcoded password literal in test fixture ('serve-pass'). Replace with a clearly fake placeholder.
Code Review SummaryStatus: No Issues Found | Recommendation: Merge Files Reviewed (6 files)
Fix these issues in Kilo Cloud Previous Review Summary (commit cb0324e)Current summary above is authoritative. Previous snapshots are kept for context only. Previous review (commit cb0324e)Status: 4 Issues Found | Recommendation: Address before merge Overview
Issue Details (click to expand)CRITICAL
WARNING
Files Reviewed (focused)
Reviewed by free · Input: 44.3K · Output: 2K · Cached: 192.3K |
Gate insecure agent TLS behind allowSelfSignedCerts, limit bad certs to the profile host, and replace GitGuardian-flagged test password literals. Co-authored-by: Cursor <cursoragent@cursor.com>
Migrate agent HTTP to /api/* with Basic auth and credentials, add AI overlay and clipboard helpers, snippet drag-reorder, optional pinch-to-zoom, and hide duplicate mobile shortcut chips while connected.
Summary
Related issues
Type of change
Platform tested
Test plan
flutter pub getflutter analyze(no errors)flutter testSteps:
Screenshots / recordings
Checklist
analysis_options.yaml