feat: add CredentialContextPins to run options #3

Merged

thklein merged 2 commits from fix/1233-pin-toolconfig-credential-context into main 2026-10-02 16:49:11 +00:00

Conversation 1 Commits 2 Files changed 2 +52 -2

thklein commented 2026-10-02 13:42:22 +00:00

Owner

Copy link

Part of the fix for basepeak-ai/bpai#1233. Merge order: basepeak-ai/gptscript#14 → this → basepeak-ai/bpai#1235.

Adds CredentialContextPins map[string][]string to Options, serialized as credentialContextPins: a pass-through for gptscript's per-credential context pins. Each named credential is resolved, and stored when newly created, in its own contexts instead of CredentialContexts.

The JSON key is the cross-repo seam. A mismatch would drop the pins silently, and a dropped pin puts the credential back in the run's head context, which is the bug being fixed. TestOptionsEncodeCredentialContextPins pins the encoded key. I verified it fails on a mistyped tag. The gptscript side has the mirror-image decode test.

The test runs without a live gptscript (GPTSCRIPT_URL=http://127.0.0.1:1 go test -run TestOptionsEncodeCredentialContextPins .). The rest of this package's suite needs a model endpoint and was not run; the change is one additive omitempty field.

Part of the fix for basepeak-ai/bpai#1233. **Merge order:** basepeak-ai/gptscript#14 → this → basepeak-ai/bpai#1235. Adds `CredentialContextPins map[string][]string` to `Options`, serialized as `credentialContextPins`: a pass-through for gptscript's per-credential context pins. Each named credential is resolved, and stored when newly created, in its own contexts instead of `CredentialContexts`. The JSON key is the cross-repo seam. A mismatch would drop the pins silently, and a dropped pin puts the credential back in the run's head context, which is the bug being fixed. `TestOptionsEncodeCredentialContextPins` pins the encoded key. I verified it fails on a mistyped tag. The gptscript side has the mirror-image decode test. The test runs without a live gptscript (`GPTSCRIPT_URL=http://127.0.0.1:1 go test -run TestOptionsEncodeCredentialContextPins .`). The rest of this package's suite needs a model endpoint and was not run; the change is one additive `omitempty` field.

thklein added 1 commit 2026-10-02 13:43:37 +00:00

feat: add CredentialContextPins to run options ... 8212eb162d

Pass-through for gptscript's per-credential context pins: each named
credential is resolved, and stored when newly created, in its own
contexts instead of CredentialContexts.

The JSON key must match what the SDK server decodes, and a mismatch would
drop the pins silently, so a test pins the encoded key.

Refs: basepeak-ai/bpai#1233

thklein force-pushed fix/1233-pin-toolconfig-credential-context from 8212eb162d to 1367aed3ce 2026-10-02 14:43:14 +00:00 Compare

thklein added 1 commit 2026-10-02 16:37:18 +00:00

feat: carry the pin kind in CredentialContextPins ... a347447804

Mirror gptscript's CredentialContextPin: each pin now names its
contexts and whether it is exclusive. A pin without Exclusive is
lookup-only, which is what a context shared between users needs: a
run must not store a user's secret there.

Refs: basepeak-ai/bpai#1233

thklein commented 2026-10-02 16:47:58 +00:00

Author

Owner

Copy link

Review round — updated to the reworked pin shape

gptscript#14 changed after review: a pin can now be lookup-only or exclusive (see the comment there for why; the short version is that a run must never write a user's secret into a context shared with other users). Options.CredentialContextPins is now map[string]CredentialContextPin{Contexts []string, Exclusive bool}, serialized as {"contexts": [...], "exclusive": true}.

TestOptionsEncodeCredentialContextPins checks both keys. I verified that a mistyped exclusive tag fails it, because losing it would silently turn a per-user pin into a lookup-only one.

The rest of this repo's suite needs a live gptscript and a model endpoint, so it was not run. golangci-lint: 0 issues. CI fails every job in 0 seconds here, on main as well, so that failure predates this change.

## Review round — updated to the reworked pin shape gptscript#14 changed after review: a pin can now be **lookup-only** or **exclusive** (see the comment there for why; the short version is that a run must never write a user's secret into a context shared with other users). `Options.CredentialContextPins` is now `map[string]CredentialContextPin{Contexts []string, Exclusive bool}`, serialized as `{"contexts": [...], "exclusive": true}`. `TestOptionsEncodeCredentialContextPins` checks both keys. I verified that a mistyped `exclusive` tag fails it, because losing it would silently turn a per-user pin into a lookup-only one. The rest of this repo's suite needs a live gptscript and a model endpoint, so it was not run. `golangci-lint`: 0 issues. CI fails every job in 0 seconds here, on `main` as well, so that failure predates this change.

thklein merged commit 6552edd7c2 into main 2026-10-02 16:49:11 +00:00

thklein deleted branch fix/1233-pin-toolconfig-credential-context 2026-10-02 16:49:12 +00:00

thklein referenced this pull request from a commit 2026-10-02 16:49:12 +00:00

feat: add CredentialContextPins to run options (#3)

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

basepeak-ai/go-gptscript!3

No description provided.