Sync upstream Centaur with TipLink deployment compatibility by fineas-bot[bot] · Pull Request #59 · TipLink/centaur

fineas-bot · 2026-06-27T23:54:55Z

Summary

Sync upstream Centaur into the TipLink fork.
Preserve required TipLink production behavior: proxy timeout support, Wilson's fork automation, TipLink image namespace/promotion paths, GitHub App token-broker bootstrap, and overlay image support.
Migrate carried patches onto the upstream api-rs shape instead of adding broad backwards-compatibility shims, including overlay sandbox mount paths, workflow sleep suspension handling, Slack thread-key stability, OAuth re-consent cleanup, and session release safety.

Audit notes

Sub-agent review covered deploy/chart behavior, api-rs/session/database surfaces, workflow migration risks, Slack identity/thread keys, console OAuth, docs, and final deployment sanity.
No major blockers remained after re-review.
Residual risk: the downstream sandbox cleanup script uses a broader session query than the old idle-candidate helper, but the staged infra change keeps dry-run as the default and calls release with cancel_inflight: false.

Validation

PATH=/Users/fin-sa/.rustup/toolchains/stable-aarch64-apple-darwin/bin:$PATH cargo fmt --check in services/api-rs
PATH=/Users/fin-sa/.rustup/toolchains/stable-aarch64-apple-darwin/bin:$PATH cargo check in services/api-rs
PATH=/Users/fin-sa/.rustup/toolchains/stable-aarch64-apple-darwin/bin:$PATH cargo fmt --check in crates/harness-server
PATH=/Users/fin-sa/.rustup/toolchains/stable-aarch64-apple-darwin/bin:$PATH cargo check in crates/harness-server
pnpm install --frozen-lockfile --ignore-scripts
pnpm --filter slackbotv2 test
pnpm --filter @centaur/api-client test
uv run python services/workflow-python/tests/test_workflow_host.py
helm lint contrib/chart
helm template centaur contrib/chart --set overlay.image.repository=ghcr.io/tiplink/fineas-centaur-overlay --set overlay.image.tag=sha-test --set repoCache.enabled=true
pnpm --dir docs build
Ruby syntax check for services/console/app/jobs/oauth/enrich_github_credential_identity_job.rb
Ruby syntax check for services/console/test/jobs/oauth/enrich_github_credential_identity_job_test.rb
git diff --check && git diff --cached --check

Not run

Focused Rails OAuth test reached the app but could not connect to local Postgres at localhost:5432 in this environment.

…paradigmxyz#617) Grant priority (direct > role) was only honored within a single secret type. The wire protocol applies the secrets array before the transforms array, so a role-granted gcp_auth always overwrote a direct static secret on the same header regardless of priority. Resolve conflicts at config-assembly time instead: each credential reports the (host-or-cidr, header-or-param) pairs it writes, and Principal#served_credentials withholds any credential that overlaps a pair a stronger grant already claimed. Only the winner is served, so proxy ordering no longer decides precedence.

Expose the company_context tool as a sandbox CLI so agents can discover and invoke it via centaur-tools.

fix(proxy): allow project access token header

* feat: label tool credential secrets * test: cover tool secret labels in reconciler * fix: preserve tool labels on duplicate secrets * refactor: narrow duplicate secret label merge * refactor: remove duplicate secret label coalescing * fix: silence centaur-perms clippy dead code * style: format iron proxy tests

Co-authored-by: Centaur AI <ai@centaur.local>

Log Slackbot v2 handoff, assistant status, and webhook wait phases so hangs before session creation leave measurable Datadog events. Add pending-operation warnings and coverage for the slow execute handoff path.

Add an API-owned session context endpoint that returns parsed Slack channel/thread metadata for Slack thread keys, plus SDK helpers for tools to fetch it. Keep the prompt guardrail, but direct agents to API-owned context first and Slack history/search only as fallback. Co-authored-by: Centaur AI <ai@centaur.local>

* test: add API integration test CI Run the Rust integration test client against the built api-rs image in PR builds. Publish a PR comment with pass/fail rows linked to the test code. * fix: use github-script for API test comments * fix: preserve registry digest for API image merge * test: use typed harness values in API integration test * test: include model and harness in mock API response * test: add workflows API integration coverage * test: run API integration checks from CI

Co-authored-by: Centaur AI <ai@centaur.local>

test: cover ETL context RLS policies

fix: terminally skip permanent slack backfill jobs

Correct the company_context pg_dsn database declaration so the proxy listener matches the centaur upstream database.

Rename the ETL context RLS migration to 0021 so it no longer collides with the readonly-role migration at 0020.

add slackbotv2 prometheus metrics

* ci: migrate workflows to depot * ci: use larger depot runners

* ci: add aggregate CI success check * ci: add rust and console success checks * ci: keep one aggregate check in CI workflow --------- Co-authored-by: zhygis <5236121+Zygimantass@users.noreply.github.com>

* ci: add rust and console success checks * ci: keep one aggregate check in CI workflow * ci: always publish aggregate checks * ci: allow skipped short-circuited jobs

* fix: keep publish image builds running * fix: preserve main image publish runs

Closes paradigmxyz#740 Closes paradigmxyz#792 Co-authored-by: Amp <amp@ampcode.com>

Co-authored-by: Centaur AI <ai@centaur.local>

+        secret = attrs[:client_secret]
+        return if secret.blank?
+
+        ref.client_secret = secret


-      credential.client_secret = secret if secret.present?
-      apply_refresh_token_seed(credential, credential_params[:refresh_token])
+      if secret.present?
+        credential.client_secret = secret


+  test "cached proxy snapshot carries gcp_id_token and invalidates when it changes" do
+    admin = users(:acme_admin)
+    secret = gcp_id_token_secrets(:acme_cloud_run)
+    Grant.create!(principal: @proxy.principal, gcp_id_token_secret: secret, created_by: admin)


+      BrokerCredential.create!({
+        namespace: "acme",
+        foreign_id: "github-github-pending-abc123",
+        name: "GitHub – Pending GitHub account",
+        token_endpoint: Oauth::Providers::Github::TOKEN_ENDPOINT,
+        oauth_app: app,
+        provider_subject: "pending-abc123",
+        access_token: "gho-token",
+        refresh_token: nil,
+        scopes: %w[repo read:user]
+      }.merge(overrides))


    refute bc.valid?
    assert bc.errors[:client_secret].any?
  end

+  test "password grant is valid with username and password" do
+    bc = build_credential(grant: "password", username: "user", password: "pass", refresh_token: nil)


+    secret.build_source(source_type: "control_plane", secret: "direct-token")
+    secret.rules.build(host: host, position: 0)
+    secret.save!
+    Grant.create!(principal: principals(:globex_user), static_secret: secret, created_by: users(:globex_admin))


+                               created_by: users(:globex_admin))
+    secret.rules.build(host: host, position: 0)
+    secret.save!
+    Grant.create!(role: roles(:globex_infra), gcp_auth_secret: secret, created_by: users(:globex_admin))


+                               created_by: users(:globex_admin))
+    secret.rules.build(host: host, position: 0)
+    secret.save!
+    Grant.create!(principal: principals(:globex_user), gcp_auth_secret: secret, created_by: users(:globex_admin))


-
-  def grantable_assoc(credential)
-    credential.class.model_name.singular.to_sym
+    Grant.create!(role: roles(:globex_infra), oauth_token_secret: secret, created_by: users(:globex_admin))


+        close = getattr(client, "close", None)
+        if callable(close):
+            close()
+    print(json.dumps(payload, indent=2, ensure_ascii=False, default=str))


 def _read_context(
    context: str | None,
    context_file: str | None,
 ) -> dict | None:
    if context and context_file:
-        print(dump_json({"status": "error", "error": "Cannot specify both --context and --context-file"}))
+        print(


-        print(dump_json({"status": "error", "error": "Cannot specify both --context and --context-file"}))
+        print(
+            dump_json(
+                {"status": "error", "error": "Cannot specify both --context and --context-file"}


-        content_disp = response.headers.get('content-disposition', '')
-        if 'cloudfront.net' in response.url and 'attachment' in content_disp:
+        content_disp = response.headers.get("content-disposition", "")
+        if "cloudfront.net" in response.url and "attachment" in content_disp:


+        close = getattr(client, "close", None)
+        if callable(close):
+            close()
+    print(json.dumps(payload, indent=2, ensure_ascii=False, default=str))


+    """Show which Preqin secret names resolve, without printing secret values."""
+    data = get_client().credential_status()
+    if json_output:
+        print(json.dumps(data, indent=2))


+    """Check Preqin Operational API auth."""
+    data = get_client().auth_health()
+    if json_output:
+        print(json.dumps(data, indent=2))


+    parsed = urllib.parse.urlsplit(value)
+    if parsed.scheme not in {"http", "https"}:
+        return value
+    if parsed.netloc.endswith("slack.com") or parsed.netloc.endswith("slack-edge.com"):


+    parsed = urllib.parse.urlsplit(value)
+    if parsed.scheme not in {"http", "https"}:
+        return value
+    if parsed.netloc.endswith("slack.com") or parsed.netloc.endswith("slack-edge.com"):


@@ -116,6 +138,7 @@
    fields: str = typer.Option(None, "--fields", "-f", help="Comma-separated field_ids"),
    cards: str = typer.Option(None, "--cards", "-c", help="Comma-separated card_ids"),
    json_output: bool = typer.Option(False, "--json", help="Output as JSON"),
+    # codeql[py/clear-text-logging-sensitive-data] Fineas excludes this upstream-only tool from runtime allowlists.


This reverts commit 2dfabef.

This reverts commit 3a886f7.

mslipper and others added 30 commits June 16, 2026 14:03

feat: add GitHub OAuth app provider (paradigmxyz#613)

412d4fc

fix: deconflict wildcard host secret grants (paradigmxyz#618)

a90453b

fix: expose company_context tool CLI

4d79cc0

Expose the company_context tool as a sandbox CLI so agents can discover and invoke it via centaur-tools.

test: specify googleapis secret deconfliction (paradigmxyz#620)

f01e0c0

feat: add Centaur Postgres read-only role (paradigmxyz#586)

b9b34a3

fix: migration name patch for readonly role add (paradigmxyz#623)

89c1584

fix(proxy): allow Railway project token header (paradigmxyz#615)

2331eda

fix(proxy): allow project access token header

Use replace mode for Slack tool secrets (paradigmxyz#629)

efb7143

Co-authored-by: Centaur AI <ai@centaur.local>

feat: record sandbox startup visibility (paradigmxyz#622)

993355b

fix: add slackbot handoff observability (paradigmxyz#634)

f1de2c9

Log Slackbot v2 handoff, assistant status, and webhook wait phases so hangs before session creation leave measurable Datadog events. Add pending-operation warnings and coverage for the slow execute handoff path.

feat: add Centaur thread investigator tool (paradigmxyz#631)

3064b1c

fix: release worker permit for cancelled tasks (paradigmxyz#635)

a492ccd

feat: log Slack render recovery health (paradigmxyz#632)

1653238

Remove stale Centaur API key guidance (paradigmxyz#636)

1819152

Co-authored-by: Centaur AI <ai@centaur.local>

feat: enforce ETL context RLS policies (paradigmxyz#630)

41fe9ae

test: cover ETL context RLS policies

fix: terminally skip permanent Slack backfill jobs (paradigmxyz#643)

b76970d

fix: terminally skip permanent slack backfill jobs

fix: correct company context DSN database

70294bf

Correct the company_context pg_dsn database declaration so the proxy listener matches the centaur upstream database.

fix: deconflict session sqlx migrations

fe94a2c

Rename the ETL context RLS migration to 0021 so it no longer collides with the readonly-role migration at 0020.

fix: restore investigator readonly Postgres queries (paradigmxyz#639)

e51fa4f

[codex] Add Slackbot v2 Prometheus metrics (paradigmxyz#641)

5402e87

add slackbotv2 prometheus metrics

[codex] migrate CI workflows to Depot (paradigmxyz#645)

31adf03

* ci: migrate workflows to depot * ci: use larger depot runners

ci: add aggregate CI success check (paradigmxyz#646)

775daae

* ci: add aggregate CI success check * ci: add rust and console success checks * ci: keep one aggregate check in CI workflow --------- Co-authored-by: zhygis <5236121+Zygimantass@users.noreply.github.com>

ci: add aggregate required checks (paradigmxyz#651)

1da7008

* ci: add rust and console success checks * ci: keep one aggregate check in CI workflow * ci: always publish aggregate checks * ci: allow skipped short-circuited jobs

fix: keep publish image builds running (paradigmxyz#650)

0e4d67a

* fix: keep publish image builds running * fix: preserve main image publish runs

feat: add qa smoke skill (paradigmxyz#648)

ca8809a

Require descriptive git-branch slugs (paradigmxyz#654)

865f01b

akshaan and others added 13 commits June 26, 2026 18:07

feat: add google docs oauth sync schema

ea9d69f

fix: propagate google oauth identity to principals

550ee89

feat: add slack retention workflow

91db99c

chore: update copy (paradigmxyz#800)

ed66973

fix: repair missing sandbox iron proxies on reuse (paradigmxyz#798)

7e300f0

Closes paradigmxyz#740 Closes paradigmxyz#792 Co-authored-by: Amp <amp@ampcode.com>

chore: add curl to api-rs image (paradigmxyz#801)

c603d0d

Fix vmetrics series and health checks (paradigmxyz#797)

dce009a

Co-authored-by: Centaur AI <ai@centaur.local>

feat: add slack retention metrics

4b153c4

feat: add google docs oauth ingest

aaac577

feat: enforce principal sandbox capabilities

845d033

fix: disable tools bootstrap without repo cache (paradigmxyz#805)

4998abd

fix: keep base tools without repo cache (paradigmxyz#806)

141e68b

Sync upstream Centaur with TipLink compatibility

51a8d48

github-advanced-security AI found potential problems Jun 27, 2026

View reviewed changes

github-advanced-security AI found potential problems Jun 28, 2026

View reviewed changes

Address CodeQL findings in upstream sync

3a886f7

fineas-bot Bot force-pushed the codex/upstream-sync-20260627 branch from 34db4aa to 3a886f7 Compare June 28, 2026 00:33

github-advanced-security AI found potential problems Jun 28, 2026

View reviewed changes

Comment thread tools/productivity/airtable/cli.py Fixed

Comment thread tools/productivity/opentable/cli.py Fixed

Comment thread tools/research/crunchbase/cli.py Fixed

Comment thread tools/research/preqin/centaur_tool_preqin/cli.py Fixed

fineas-bot Bot force-pushed the codex/upstream-sync-20260627 branch 5 times, most recently from 8b80fb5 to 7803151 Compare June 28, 2026 01:50

Address CodeQL secret handling alerts

2dfabef

fineas-bot Bot force-pushed the codex/upstream-sync-20260627 branch from 7803151 to 2dfabef Compare June 28, 2026 01:54

fin-sa added 2 commits June 27, 2026 21:55

Revert "Address CodeQL secret handling alerts"

f58f115

This reverts commit 2dfabef.

Revert "Address CodeQL findings in upstream sync"

6b0c3b0

This reverts commit 3a886f7.

GoonMachine merged commit 51877d9 into main Jun 28, 2026
10 of 30 checks passed

fineas-bot Bot mentioned this pull request Jun 28, 2026

Restore GitHub-hosted workflow runners #60

Merged

Navigation Menu

Uh oh!

Sync upstream Centaur with TipLink deployment compatibility - #59

Sync upstream Centaur with TipLink deployment compatibility#59
GoonMachine merged 154 commits into
mainfrom
codex/upstream-sync-20260627

fineas-bot Bot commented Jun 27, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

14 participants

Uh oh!

Conversation

fineas-bot Bot commented Jun 27, 2026

Summary

Audit notes

Validation

Not run

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

14 participants