imperal-sdk 6.3.1__tar.gz → 6.3.2__tar.gz

{imperal_sdk-6.3.1 → imperal_sdk-6.3.2}/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 All notable changes to `imperal-sdk` are documented here.
 
+## 6.3.2 — 2026-10-20
+
+### Security
+- `clean_remote` (new, public): a git remote is cleaned by parsing it — a URL rebuilt from scheme, host,
+  port and path (userinfo split on its last `@`, query and fragment dropped), a `user:secret` dropped from
+  an scp-like remote, `""` for what does not parse. `git_identity` and `sftp_read_meta` use it (6.3.1's
+  regex could leave part of a password behind).
+
 ## 6.3.1 — 2026-10-20
 
 ### Security

{imperal_sdk-6.3.1 → imperal_sdk-6.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: imperal-sdk
-Version: 6.3.1
+Version: 6.3.2
 Summary: SDK for building Imperal Cloud extensions
 Author: Valentin Scerbacov, Imperal, Inc.
 License-Expression: Apache-2.0

{imperal_sdk-6.3.1 → imperal_sdk-6.3.2}/sdk-reference.json

@@ -1,5 +1,5 @@
 {
-  "sdk_version": "6.3.1",
+  "sdk_version": "6.3.2",
   "symbols": {
     "ActionResult": {
       "action_vocab_safe": false,

{imperal_sdk-6.3.1 → imperal_sdk-6.3.2}/sdk_claims.json

@@ -1,5 +1,5 @@
 {
-  "_sdk_version": "6.3.1",
+  "_sdk_version": "6.3.2",
   "constants": {
     "max_call_depth": {
       "counts_root": true,

{imperal_sdk-6.3.1 → imperal_sdk-6.3.2}/src/imperal_sdk/__init__.py

@@ -1,7 +1,7 @@
 """Imperal Cloud SDK — build extensions for the Imperal platform."""
 from typing import TYPE_CHECKING
 
-__version__ = "6.3.1"
+__version__ = "6.3.2"
 
 # 5.2.2 (2026-06-11): the package root resolves its public surface lazily
 # (PEP 562). The eager imports pulled the HTTP transport (Context / client

{imperal_sdk-6.3.1 → imperal_sdk-6.3.2}/src/imperal_sdk/code_index.py

@@ -1351,7 +1351,29 @@ def build_index(root: str, files: list[str]) -> ProjectIndex:
 
 _HEAD_REF = re.compile(r"ref:\s*refs/heads/(\S+)")
 _SHA = re.compile(r"^[0-9a-f]{40}$")
-_USERINFO = re.compile(r"^([a-z][a-z0-9+.-]*://)[^/@]*@", re.I)
+def clean_remote(url) -> str:
+    """A git remote without any credentials: a URL is rebuilt from scheme, host, port and path (the userinfo
+    split on its LAST ``@`` and dropped, query and fragment dropped); an scp-like ``user@host:path`` keeps a
+    plain user and drops a ``user:secret``; a value that does not parse is ``""``. Shared word for word
+    by the vault (``stores/repos.clean_remote``)."""
+    from urllib.parse import urlsplit, urlunsplit
+    u = str(url or "").strip().strip('"').strip("'").strip()
+    if not u or any(c.isspace() for c in u):
+        return ""
+    if "://" in u:
+        try:
+            parts = urlsplit(u)
+            host, port = parts.hostname or "", parts.port
+        except ValueError:
+            return ""
+        if not parts.scheme or (not host and parts.scheme != "file"):
+            return ""
+        netloc = (f"[{host}]" if ":" in host else host) + (f":{port}" if port else "")
+        return urlunsplit((parts.scheme, netloc, parts.path, "", ""))
+    user, at, rest = u.rpartition("@")
+    if at and ":" in user:
+        return rest                 # "user:secret@host:path": the secret never leaves
+    return u
 
 
 def _meta_text(meta: dict, key: str) -> str:
@@ -1390,7 +1412,7 @@ def git_identity(meta: dict) -> dict:
             first = first or url
             if section == '[remote"origin"]':
                 remote = url
-    remote = _USERINFO.sub(r"\1", remote or first)
+    remote = clean_remote(remote or first)
     return {"remote": remote, "branch": branch, "commit": commit}
 
 

{imperal_sdk-6.3.1 → imperal_sdk-6.3.2}/tests/test_code_index_indexer.py

@@ -382,3 +382,14 @@ def test_sftp_reads_never_follow_a_link_and_never_ship_git_credentials():
     assert ci.git_identity(meta["files"])["remote"] == "https://git.x/r.git"
     many = asyncio.run(ci.sftp_read_many(S(), "/r", ["app/x.py", "out/passwd", "tsconfig.json"]))
     assert many["files"] == {"app/x.py": b"x = 1\n"} and set(many["skipped"]) == {"out/passwd", "tsconfig.json"}
+
+
+def test_a_remote_never_carries_credentials_however_it_is_written():
+    from imperal_sdk.code_index import clean_remote
+    assert clean_remote("https://u:p@ss@host.x/r.git") == "https://host.x/r.git"
+    assert clean_remote('"https://bob:tok@git.x:8443/r.git?x=1#f"') == "https://git.x:8443/r.git"
+    assert clean_remote("ssh://git@host/r.git") == "ssh://host/r.git"
+    assert clean_remote("git@github.com:org/r.git") == "git@github.com:org/r.git"
+    assert clean_remote("bob:secret@host:r.git") == "host:r.git"
+    assert clean_remote("https://[::1]:9/r") == "https://[::1]:9/r" and clean_remote("http://h:bad/r") == ""
+    assert clean_remote("") == "" and clean_remote("a b") == ""