t18698: Default-aware credential consumers: onboarding and MCP validation honour the declared provider default by marcusquinn · Pull Request #34735 · marcusquinn/aidevops

marcusquinn · 2026-10-15T00:32:05Z

Summary

Stacked on #34732 (t18696), which provides default injection. Base is the #34732 branch, so this diff shows only the consumer changes.

Onboarding and MCP validation no longer assume one unlabelled CLOUDFLARE_API_TOKEN. When that variable is not exported, they read the credential registry:

State	Onboarding status	MCP validation
`CLOUDFLARE_API_TOKEN` exported	`ready (API token configured)`, unchanged	existing test, unchanged
Default declared	`ready (default: NAME)`	connectivity test through `aidevops secret CLOUDFLARE_API_TOKEN -- ...` (default injection) against `/user/tokens/verify`
Tokens stored, no default declared	`partial (N stored, no default declared …)` (previously `needs-setup`)	warning that names `aidevops secret default cloudflare NAME`
Tokens stored, explicitly no default	`ready (N stored, explicitly no default)`	warning: tools must name an account-specific token
Nothing stored	`needs-setup`	warning

The count is registered cloudflare credentials plus stored-but-undescribed CLOUDFLARE_*TOKEN|KEY names, using names only.
onboarding-helper.sh json keeps hosting.cloudflare.configured and adds status / detail.
The Cloudflare setup guide no longer suggests storing a bare CLOUDFLARE_API_TOKEN. It shows account add, set CLOUDFLARE_<ACCOUNT>_API_TOKEN --provider cloudflare --account … and an optional secret default cloudflare NAME (or --none). Onboarding never creates a default.
The new connectivity test passes the bearer header to curl on stdin (-H @-), so the token never appears in any process argv.

Files

.agents/scripts/onboarding-helper.sh: _cloudflare_status / _cloudflare_credential_count, used by status and json; setup guide.
.agents/scripts/validate-mcp-integrations.sh: test_cloudflare_registry_default for the not-exported path.
.agents/tools/api/cloudflare-cf-cli.md: "Choosing the token": describe, resolve cloudflare exit codes and default injection.

Verification

Isolated-HOME runtime script with a curl stub on PATH (no network; the stub passes only when the stdin header carries the expected token):

Nothing stored → needs-setup.
Two suffixed tokens, no default → partial, configured: true; the registry defaults stays {} (onboarding wrote nothing).
Explicit --none → ready (2 stored, explicitly no default); MCP warns.
Explicit default → ready (default: CLOUDFLARE_ACME_API_TOKEN); MCP connectivity test PASSED via injection; the token is absent from curl argv.
Exported CLOUDFLARE_API_TOKEN → ready (API token configured), as before.
guide cloudflare shows account-specific names and the optional default.
ShellCheck is clean for both scripts, markdownlint is clean, and pre-commit ratchets pass.

aidevops.sh v3.39.31 plugin for OpenCode v1.19.0 with claude-opus-5-5 spent 1h and 286,726 tokens on this with the user in an interactive session.

…(GH#34717)

… threshold (GH#34717)

…dules under qlty file-complexity (GH#34717)

…jection (GH#34718)

…, GH#34717)

…ory-multi-account-provi' into feature/gh34718-credential-aliases-defaults-injection # Conflicts: # .agents/scripts/credential_inventory.py

…n (GH#34720)

coderabbitai · 2026-10-15T00:32:28Z

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one): 1

🚫 Excluded labels (none allowed): 1

no-review

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: marcusquinn/aidevops/.coderabbit.yaml
Review profile: CHILL
Plan: Advanced
Run ID: 8cbfb15b-7dfd-48ea-a71f-58062827c58c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

…ory-multi-account-provi' into feature/gh34718-credential-aliases-defaults-injection # Conflicts: # .agents/scripts/credential_inventory.py

codacy-production · 2026-10-15T00:33:27Z

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer}
_{TIP This summary will be updated as you push new changes.}

…es-defaults-injection' into feature/gh34720-default-aware-credential-consumers

github-actions · 2026-10-15T00:33:49Z

Qlty Smell Regression Gate

✅ No change — smell count unchanged.

Metric	Base (`f49cf89`)	Head (`65bdbdc`)	Delta
Total smells	65	65	+0

…lt-aware-credential-consumers # Conflicts: # TODO.md

github-actions · 2026-10-15T01:21:37Z

Markdown Lint (changed-line scoped)

No new violations in changed lines (0 pre-existing in touched files — ignored).

Metric	Base (`f49cf89`)	Head (`65bdbdc`)
Total in touched files	—	0
New (in changed lines)	—	0

github-actions · 2026-10-15T01:21:47Z

Bash 3.2 Compatibility Regression Gate

✅ No regression — no new bash 3.2-incompatible construct(s).

Metric	Base (`f49cf89`)	Head (`65bdbdc`)
Total bash 3.2-incompatible construct(s)	0	0

github-actions · 2026-10-15T01:21:49Z

Shell Function Complexity Regression Gate

✅ No regression — no new function(s) >100 lines.

Metric	Base (`f49cf89`)	Head (`65bdbdc`)
Total function(s) >100 lines	0	0

github-actions · 2026-10-15T01:24:13Z

Shell Nesting Depth Regression Gate

✅ No regression — no new file(s) with nesting depth >8.

Metric	Base (`f49cf89`)	Head (`65bdbdc`)
Total file(s) with nesting depth >8	0	0

github-actions · 2026-10-15T01:24:21Z

File Size Regression Gate

✅ No regression — no new non-README Markdown file(s) >1000 lines at root / >500 elsewhere.

Metric	Base (`f49cf89`)	Head (`65bdbdc`)
Total non-README Markdown file(s) >1000 lines at root / >500 elsewhere	0	0

github-actions · 2026-10-15T01:24:26Z

🔍 Code Quality Report

�[0;35m[MONITOR]�[0m Code Review Monitoring Report

SonarCloud: 0 bugs, 0 vulnerabilities, 1 code smells

Thu Oct 15 01:21:55 UTC 2026: Code review monitoring started
Thu Oct 15 01:21:55 UTC 2026: SonarCloud - Bugs: 0, Vulnerabilities: 0, Code Smells: 1
Thu Oct 15 01:24:17 UTC 2026: Codacy analysis completed - issues found (exit 2)

📈 Current Quality Metrics

BUGS: 0
CODE SMELLS: 1
VULNERABILITIES: 0

Generated on: Thu Oct 15 01:24:18 UTC 2026

Generated by AI DevOps Framework Code Review Monitoring

Planning-Publication-ID: 11f861177ca0e6b867f97c45268f6f2b38f455fd Planning-Publication-Handoff-ID: 91d670eed39d43d3a63337304ccc80edfc9edba1

marcusquinn added 7 commits October 15, 2026 01:09

feat: non-secret credential registry with explicit provider defaults …

ed8529c

…(GH#34717)

refactor: extract set option parsing to keep cmd_set under complexity…

eb5ee33

… threshold (GH#34717)

refactor: split credential registry into fields/schema/names/store mo…

07452c7

…dules under qlty file-complexity (GH#34717)

feat: resolve credential aliases and explicit provider defaults at in…

8dec64c

…jection (GH#34718)

fix: use absolute bash for inventory subprocess (CodeFactor B603/B607…

32b54b7

…, GH#34717)

Merge remote-tracking branch 'origin/bugfix/gh34680-credential-invent…

0a86701

…ory-multi-account-provi' into feature/gh34718-credential-aliases-defaults-injection # Conflicts: # .agents/scripts/credential_inventory.py

feat: default-aware Cloudflare status in onboarding and MCP validatio…

d054b5c

…n (GH#34720)

marcusquinn added the origin:interactive Created by interactive user session label Oct 15, 2026

marcusquinn added 2 commits October 15, 2026 01:32

fix: annotate subprocess import (Bandit B404, GH#34717)

c2ae420

Merge remote-tracking branch 'origin/bugfix/gh34680-credential-invent…

fc602c9

…ory-multi-account-provi' into feature/gh34718-credential-aliases-defaults-injection # Conflicts: # .agents/scripts/credential_inventory.py

Merge remote-tracking branch 'origin/feature/gh34718-credential-alias…

5a168a1

…es-defaults-injection' into feature/gh34720-default-aware-credential-consumers

vladimirdulov mentioned this pull request Oct 15, 2026

[Supervisor:vladimirdulov] 1 open PR, 0 issues assigned, 0 local workers — changed 2026-10-16 09:57 UTC #23855

Open

marcusquinn marked this pull request as ready for review October 15, 2026 01:01

marcusquinn changed the base branch from feature/gh34718-credential-aliases-defaults-injection to main October 15, 2026 01:15

Merge remote-tracking branch 'origin/main' into feature/gh34720-defau…

65bdbdc

…lt-aware-credential-consumers # Conflicts: # TODO.md

marcusquinn merged commit c304f69 into main Oct 15, 2026
54 checks passed

marcusquinn deleted the feature/gh34720-default-aware-credential-consumers branch October 15, 2026 01:29

github-actions Bot added the status:done Task is complete label Oct 15, 2026

github-actions Bot mentioned this pull request Oct 15, 2026

t18698: Default-aware credential consumers: onboarding and MCP validation honour the declared provider default #34720

Closed

3 tasks

marcusquinn pushed a commit that referenced this pull request Oct 15, 2026

chore: mark t18698 complete (pr:#34735 completed:2026-10-15)

402895e

Planning-Publication-ID: 11f861177ca0e6b867f97c45268f6f2b38f455fd Planning-Publication-Handoff-ID: 91d670eed39d43d3a63337304ccc80edfc9edba1

vladimirdulov added the review-feedback-scanned Merged PR already scanned for quality feedback label Oct 15, 2026

marcusquinn mentioned this pull request Oct 15, 2026

Multi-account providers: credentials become unidentifiable as an operator grows from one account to many #34680

Closed

Navigation Menu

Repository navigation

t18698: Default-aware credential consumers: onboarding and MCP validation honour the declared provider default - #34735

t18698: Default-aware credential consumers: onboarding and MCP validation honour the declared provider default#34735
marcusquinn merged 11 commits into
mainfrom
feature/gh34720-default-aware-credential-consumers

marcusquinn commented Oct 15, 2026

Uh oh!

coderabbitai Bot commented Oct 15, 2026 •

edited

Loading

Review skipped

Uh oh!

codacy-production Bot commented Oct 15, 2026

Uh oh!

github-actions Bot commented Oct 15, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 15, 2026

Uh oh!

github-actions Bot commented Oct 15, 2026

Uh oh!

github-actions Bot commented Oct 15, 2026

Uh oh!

github-actions Bot commented Oct 15, 2026

Uh oh!

github-actions Bot commented Oct 15, 2026

Uh oh!

github-actions Bot commented Oct 15, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

marcusquinn commented Oct 15, 2026

Summary

Files

Verification

Uh oh!

coderabbitai Bot commented Oct 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

codacy-production Bot commented Oct 15, 2026

Up to standards ✅

Uh oh!

github-actions Bot commented Oct 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Qlty Smell Regression Gate

Uh oh!

github-actions Bot commented Oct 15, 2026

Markdown Lint (changed-line scoped)

Uh oh!

github-actions Bot commented Oct 15, 2026

Bash 3.2 Compatibility Regression Gate

Uh oh!

github-actions Bot commented Oct 15, 2026

Shell Function Complexity Regression Gate

Uh oh!

github-actions Bot commented Oct 15, 2026

Shell Nesting Depth Regression Gate

Uh oh!

github-actions Bot commented Oct 15, 2026

File Size Regression Gate

Uh oh!

github-actions Bot commented Oct 15, 2026

🔍 Code Quality Report

📈 Current Quality Metrics

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

coderabbitai Bot commented Oct 15, 2026 •

edited

Loading

github-actions Bot commented Oct 15, 2026 •

edited

Loading