docs(starter-prompt): slim credential capture guidance#6477
Merged
cv merged 1 commit intoJul 8, 2026
Conversation
Reduce the "Handle Tokens Securely and Visually" section of the copy-paste starter prompt to the pinned helper/form trust boundary, one canonical isolated-profile recipe, and the core safety rules. Move install-time account-home and curl | bash mechanics off the non-technical prompt: prefer the installer's own secure credential prompt and stop asking the agent to hand-assemble a curl | bash wrapper. The hardened helper still enforces loopback-only access, one-shot submission, absolute executables, and ambient env stripping, so the slimmer prompt keeps the same security posture with far less procedural reasoning for the agent. Update the starter-prompt docs test to match and guard against the wrapper prose creeping back. Signed-off-by: Miyoung Choi <miyoungc@nvidia.com>
Contributor
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Contributor
Code Coverage OverviewLanguages: TypeScript TypeScript / code-coverage/pluginThe overall coverage in the branch is 96%. Coverage data for the branch is not yet available. Show a code coverage summary of the most covered files.
TypeScript / code-coverage/cliThe overall coverage in the branch is 76%. Coverage data for the branch is not yet available. Show a code coverage summary of the most covered files.
Updated |
Contributor
E2E Advisor RecommendationRequired E2E: None Full advisor summaryE2E Recommendation AdvisorBase: Required E2E
Optional E2E
New E2E recommendations
|
Contributor
E2E Target RecommendationRequired E2E targets: None Full E2E target advisor summaryE2E Target AdvisorBase: Required E2E targets
Optional E2E targets
Relevant changed files
|
Contributor
PR Review Advisor (Nemotron Ultra) — Changes requestedMerge posture: Do not merge yet Action checklist
Findings index
Review findings by urgency: 0 required fixes, 3 items to resolve/justify, 2 in-scope improvements
|
Contributor
PR Review Advisor — Changes requestedMerge posture: Do not merge yet Action checklist
Findings index
Review findings by urgency: 0 required fixes, 2 items to resolve/justify, 0 in-scope improvements
|
21 tasks
cv
approved these changes
Jul 8, 2026
wscurran
added
area: docs
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Stacked on top of #6439. Keeps the hardened credential helper and form from that PR, but slims the copy-paste starter prompt so the default "non-technical user" onboarding path stays easy. The prompt no longer asks the coding agent to synthesize execution-profile prose, per-tool env-strip reasoning, or a
curl | bashcredential wrapper.Related Issue
Follow-up to #6439. Merge #6439 first, then this on top.
Changes
STARTER_PROMPTfrom ~18 dense bullets to 10, keeping the pinned helper/form URLs and SHA-256 digests, one canonical--execution-profile isolatedrecipe, and the core safety rules (verify digests, one-shot confirm-then-run, redacted preview, no secrets in chat or argv, exposure-minimization).NPM_CONFIG_*/PIP_*env-strip enumeration, Windows.cmdhandling, and thebash -cnon-exported-variablecurl | bashwrapper. Compressaccount-hometo one line and prefer the installer's own secure credential prompt for install-time secrets.test/starter-prompt-docs.test.tsto match, and addnot.toContainregression guards so the wrapper synthesis prose cannot creep back into the copied prompt.The hardened helper still enforces loopback-only access, one-shot submission, absolute executables, and ambient env stripping, so the slimmer prompt keeps the same security posture with far less procedural reasoning for the agent. Helper and form bytes are unchanged, so the pinned digests and commit stay valid.
Type of Change
Quality Gates
scripts/checks/local-credential-helper-pin.tspasses, and this is intended to be reviewed on top of fix(security): harden local credential capture #6439.Verification
Verifiedin GitHubpre-commit,commit-msg, andpre-pushhooks passed, ornpm run check:diffpassed when hooks were skipped or unavailablenpx vitest run --project integration test/starter-prompt-docs.test.ts test/local-credential-helper-pin.test.tspassed 42/42, andnode --experimental-strip-types scripts/checks/local-credential-helper-pin.tsreported pins immutable and current.npm run docsbuilds without warnings (doc changes only) — not run; change is prose inside the existingSTARTER_PROMPTtemplate literal, validated by the TS-AST pin check and starter-prompt tests.Signed-off-by: Miyoung Choi miyoungc@nvidia.com