Repository navigation
Warn that diagnostic access includes backups with saved credentials - #1729
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a4b18249bb
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "ftw.logs.read": "Read the box's logs, with names and secrets taken out", | ||
| "ftw.config.read": "Read the settings, with names and secrets taken out", | ||
| "ftw.diag.run": "Run checks that change nothing", | ||
| "ftw.diag.run": "Read full technical diagnostics, source, logs and backups; backups can contain saved credentials", |
There was a problem hiding this comment.
The commit states that human review of the rendered consent remains pending. Because this changes security-sensitive consent text shown in the Access UI, mock rendering and automated tests do not satisfy the repository's requirement that a human inspect the rendered interface; complete that inspection before treating the change as review-ready.
AGENTS.md reference: AGENTS.md:L142-L144
Useful? React with 👍 / 👎.
d39607e to
46a5636
Compare
a4b1824 to
ffd1c54
Compare
ffd1c54 to
475785f
Compare
1 participant
The box currently describes
ftw.diag.runas checks that change nothing. The shared MCP beta can read full technical exports, including backups with saved credentials, so the final box consent must state that before the owner grants access.Use the same warning as FTW Cloud and refresh the Access script cache key from
access2toaccess3. This changes the explanation only; it adds no scopes or access rules.Depends on #1684. This PR targets
claude/box-access-namesto preserve its car and charger names and itsaccess2cache change. The parent Access page (#1682) already merged into master. #1684 now targets master and preserves its later app/fleet cache keys; this branch follows its new head and keeps access3.Validation: the new credential-warning regression fails before this change and passes after. All browser tests and
make verifypass. Rendered the actual consent offer at 390 px in light and dark themes and 1120 px in dark, using local mocked responses; the warning stays visible without horizontal overflow. No live grant, box change, merge or release occurred. Fredrik reviewed and approved the rendered consent in the coordinated beta chat on 18 October 2026. The only automated review finding concerned that human inspection. The master-based branch also passes make verify and its Access browser tests.