feat: point gitlab-cli at a self-hosted host via GITLAB_HOST by sgraband · Pull Request #35 · eclipse-enclave/enclave

sgraband · 2026-07-31T08:14:20Z

What it does

Reaching a self-hosted GitLab needed two manual steps: declare GITLAB_HOST so it reached the container, then edit the mixin spec to put the host in serviceAuth.hosts. Both are now unnecessary.

serviceAuth entries gain hostsFromCredential, naming a credential whose resolved value is a host. When it resolves, its value replaces that service's declared hosts. Replacement rather than addition is deliberate: an instance-specific token must not be released to gitlab.com as well.

The override is resolved during auth setup, before the effective policy is resolved and cached, so the host flows into the allow set through the existing ReleaseHosts union and stays reachable. gitlab-cli declares GITLAB_HOST as a non-apiKey credential and wires all three tokens to it.

Closes #4

How to test

Follow-ups

Breaking changes

This PR introduces breaking changes and has been coordinated with maintainers.

Review checklist

As an author, I have thoroughly tested my changes and carefully followed the contribution guidelines.

Reaching a self-hosted GitLab needed two manual steps: declare GITLAB_HOST so it reached the container, then edit the mixin spec to put the host in serviceAuth.hosts. Both are now unnecessary. serviceAuth entries gain hostsFromCredential, naming a credential whose resolved value is a host. When it resolves, its value replaces that service's declared hosts. Replacement rather than addition is deliberate: an instance-specific token must not be released to gitlab.com as well. The override is resolved during auth setup, before the effective policy is resolved and cached, so the host flows into the allow set through the existing ReleaseHosts union and stays reachable. gitlab-cli declares GITLAB_HOST as a non-apiKey credential and wires all three tokens to it. Closes eclipse-enclave#4

sdirix · 2026-08-03T11:19:50Z

@EclipseSourceAI

EclipseSourceAI

Note

Autonomous AI review. Generated automatically, so it may contain mistakes. Feel free to ignore any comment you disagree with (noting why helps future reviews).

This review does not approve the change. A human still needs to review it and sign off on the overall architecture and design.

To get an updated review after pushing changes, re-request a review from this account.

Submitted via review-guard-mcp

Adds network.serviceAuth.<id>.hostsFromCredential so a service's HTTP-release hosts can be selected at runtime from another declared credential, and wires gitlab-cli's three tokens to a new gitlab-host (GITLAB_HOST) credential. The plumbing fits the existing shape well: spec validation sits next to the existing serviceAuth cross-reference check, the runtime reuses resolveActiveSecretValue and domainpattern, and releaseHosts clones the secret map so the loaded spec is not mutated. Build, tests, make lint and make generate are all clean.

Two areas deserve a human look. First, replacement narrows the DNS allow set as well as the token release targets, so for tools whose built-in allowlist lacks the gitlab fragment (everything except claude) setting GITLAB_HOST makes gitlab.com unreachable for the whole session, which the stated rationale does not require. Second, the override lands in a mutable Runtime field whose correctness depends on running before the memoized effective-policy resolution, enforced only by a comment.

The rest are smaller: an unredacted credential value in a warning, a wrong per-project secrets path in the feature README, network apply recomputing the bundle without the override, and the host sticking via the persisted env store. Details inline.

EclipseSourceAI · 2026-08-03T11:31:35Z

+		host, err = domainpattern.Normalize(host)
+	}
+	if err != nil {
+		logx.Warnf("Secret %s: value %q is not a usable host (%v); keeping declared hosts.", secretID, value, err)


This prints the credential value verbatim at warn level. If hostsFromCredential ever points at a token (or GITLAB_HOST gets a token value by mistake), the secret lands in the terminal. Everywhere else secret-derived values go through util.RedactSecret, and at debug level:

enclave/internal/runtime/auth_manager.go

Line 208 in 5e80820

logx.Debugf("Injected %s from %s (%s)", envVar, secretSource, util.RedactSecret(envValue))

EclipseSourceAI · 2026-08-03T11:31:36Z

+// serviceAuth.hostsFromCredential replacement applied, so a host selected at
+// runtime becomes resolvable exactly like a declared one. The loaded spec is
+// left untouched.
+func (r *Runtime) releaseHosts(secrets map[string]model.SecretConfig) []string {


The replacement narrows the DNS allow set too, not just the token release targets. Only claude's built-in allowlist pulls in the gitlab fragment (

enclave/extensions/tools/claude/gateway-allowlist.conf

Line 27 in 5e80820

conf-file=/etc/dnsmasq.allowlists/fragments/gitlab.conf

), so for codex/opencode/theia the feature's release hosts are the only source of gitlab.com and setting GITLAB_HOST makes gitlab.com unresolvable for the whole session. The rationale in the PR description only needs the release hosts narrowed, so releaseHosts could keep the declared hosts while releaseHostsFor uses only the override.

EclipseSourceAI · 2026-08-03T11:31:37Z

 	}
+	// Must precede shouldUseSecretReleases: that call resolves and caches the
+	// effective policy, which unions the release hosts into the allow set.
+	m.releaseHostOverrides = resolveReleaseHostOverrides(eligibleSecrets, m.host.Home, layeredSecrets, persistedEnv)


The invariant is enforced only by this comment, and resolveEffectivePolicy memoizes on the Runtime (

enclave/internal/runtime/runtime.go

Lines 1507 to 1511 in 5e80820

func (r *Runtime) resolveEffectivePolicy() (policy.ResolveResult, error) {

if r.policyResolved {

return r.policyResult, r.policyErr

}

r.policyResolved = true

). It holds today, but a future policy lookup anywhere in prepareMounts (which runs before prepareVolumes) would silently cache an allow set without the override while the token still targets it. Either reset policyResolved here when overrides are non-empty, or fail loudly if the policy is already resolved.

EclipseSourceAI · 2026-08-03T11:31:38Z

+
+To set it persistently, put it in a secrets file rather than the shell — global
+in `~/.local/state/enclave/secrets/global.env`, or per project under
+`~/.local/state/enclave/projects/<hash>/`.


Wrong path. Per-project secrets live at ~/.local/state/enclave/secrets/projects/<hash>/<tool>.env (

enclave/docs/auth.md

Lines 136 to 138 in 5e80820

| 1 | `~/.local/state/enclave/secrets/global.env` | All agents, all projects |

| 2 | `~/.local/state/enclave/secrets/global/<tool>.env` | Specific agent, all projects |

| 3 | `~/.local/state/enclave/secrets/projects/<hash>/<tool>.env` | Specific agent, specific project |

), and that file is keyed by the tool (e.g. claude.env), not by the feature, which is worth spelling out since this is a mixin.

EclipseSourceAI · 2026-08-03T11:31:39Z

+```
+
+That single env var selects the instance for `glab`, retargets token injection,
+and joins the network allowlist — no spec edit or `allow_domains` entry. See


True at session start, but enclave network apply recomputes the desired bundle from the tool profile only, with no features and no runtime overrides (

enclave/internal/policy/effective_resolver.go

Lines 134 to 143 in 5e80820

func (r EffectiveResolver) loadSpecDomains(tool string) (allowed []string, denied []string, err error) {

profile, err := config.LoadProfile(r.paths, tool)

if err != nil {

if errors.Is(err, os.ErrNotExist) {

return nil, nil, nil

}

return nil, nil, fmt.Errorf("load spec domains for %q: %w", tool, err)

}

allowed = append(append([]string(nil), profile.AllowedDomains...), model.ReleaseHosts(profile.Secrets)...)

return allowed, profile.DeniedDomains, nil

), then rewrites it (

enclave/internal/app/network_cmd.go

Lines 291 to 295 in 5e80820

applyErr = bundle.WriteConfigBundle(bundle.BundleWriteConfig{

Dir: expectedBundleDir,

Policy: resolved.Effective,

Tool: target.Tool,

})

). So network status reports drift and an apply cuts the self-hosted host out of a running session. The gap already exists for gitlab.com, but a follow-up issue would be good since the override makes it the only host the token can reach.

EclipseSourceAI · 2026-08-03T11:31:40Z

+- `network.serviceAuth.<service-id>.hostsFromCredential` names another
+  `credentials.sources` id whose resolved value is a host, for services that
+  can point at a self-hosted instance. When that credential resolves, its value
+  **replaces** the declared `hosts` for this service — it is not additive,


It replaces the union of hosts and the serviceDomains-derived hosts, not just the declared hosts: both go into the same list in buildSecrets (

enclave/internal/config/spec_map.go

Lines 115 to 124 in 5e80820

hostsByService := map[string][]string{}

if doc.Network != nil {

for host, id := range doc.Network.ServiceDomains {

hostsByService[id] = append(hostsByService[id], host)

}

for id, auth := range doc.Network.ServiceAuth {

hostsByService[id] = append(hostsByService[id], auth.Hosts...)

}

for id := range hostsByService {

hostsByService[id] = sortDedupeStrings(hostsByService[id])

). Matters for specs like github-cli that express hosts via serviceDomains.

EclipseSourceAI · 2026-08-03T11:31:41Z

    gitlab-job-token: { env: [JOB_TOKEN, CI_JOB_TOKEN] }
+    # Not a credential: glab reads GITLAB_HOST to pick the instance, and
+    # hostsFromCredential below retargets token injection at it.
+    gitlab-host: { env: [GITLAB_HOST], apiKey: false }


Because this is a declared credential, the resolved GITLAB_HOST is written to the persisted env store under the default --persist, so later runs without the env var keep the self-hosted override (and keep gitlab.com out of the release hosts). That contradicts "An unset credential keeps the declared hosts" in the docs, so either document how to clear it or skip persistence for non-apiKey host credentials.

EclipseSourceAI · 2026-08-03T11:31:42Z

+			continue
+		}
+		for _, id := range secretIDs {
+			overrides[id] = []string{host}


A successful override is completely silent, and the injection debug log redacts the value, so there is no way to see which host was picked. An info line here would help, similar to how ad-hoc allowlisted domains are reported:

enclave/internal/runtime/network_manager.go

Line 81 in 5e80820

logx.Infof("Allowlisted ad-hoc domains: %s", strings.Join(m.run.AllowDomains, ", "))

EclipseSourceAI · 2026-08-03T11:31:43Z

+	// otherwise become a bogus allowlist entry.
+	host, err := domainpattern.NormalizeHost(trimmed)
+	if err == nil {
+		host, err = domainpattern.Normalize(host)


domainpattern.Normalize accepts wildcard patterns, so GITLAB_HOST=*.example.com becomes a wildcard release target and allowlist entry. That works against the "names the one instance the token belongs to" rationale, so rejecting * here seems right.

EclipseSourceAI reviewed Aug 3, 2026

View reviewed changes

Navigation Menu

Uh oh!

feat: point gitlab-cli at a self-hosted host via GITLAB_HOST - #35

feat: point gitlab-cli at a self-hosted host via GITLAB_HOST#35
sgraband wants to merge 1 commit into
eclipse-enclave:mainfrom
sgraband:feat/gitlab-cli-self-hosted-host

sgraband commented Jul 31, 2026

Uh oh!

sdirix commented Aug 3, 2026

Uh oh!

EclipseSourceAI left a comment

Uh oh!

EclipseSourceAI Aug 3, 2026

Uh oh!

EclipseSourceAI Aug 3, 2026

Uh oh!

EclipseSourceAI Aug 3, 2026

Uh oh!

EclipseSourceAI Aug 3, 2026

Uh oh!

EclipseSourceAI Aug 3, 2026

Uh oh!

EclipseSourceAI Aug 3, 2026

Uh oh!

EclipseSourceAI Aug 3, 2026

Uh oh!

EclipseSourceAI Aug 3, 2026

Uh oh!

EclipseSourceAI Aug 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	func (r *Runtime) resolveEffectivePolicy() (policy.ResolveResult, error) {
	if r.policyResolved {
	return r.policyResult, r.policyErr
	}
	r.policyResolved = true

	\| 1 \| `~/.local/state/enclave/secrets/global.env` \| All agents, all projects \|
	\| 2 \| `~/.local/state/enclave/secrets/global/<tool>.env` \| Specific agent, all projects \|
	\| 3 \| `~/.local/state/enclave/secrets/projects/<hash>/<tool>.env` \| Specific agent, specific project \|

	func (r EffectiveResolver) loadSpecDomains(tool string) (allowed []string, denied []string, err error) {
	profile, err := config.LoadProfile(r.paths, tool)
	if err != nil {
	if errors.Is(err, os.ErrNotExist) {
	return nil, nil, nil
	}
	return nil, nil, fmt.Errorf("load spec domains for %q: %w", tool, err)
	}
	allowed = append(append([]string(nil), profile.AllowedDomains...), model.ReleaseHosts(profile.Secrets)...)
	return allowed, profile.DeniedDomains, nil

	applyErr = bundle.WriteConfigBundle(bundle.BundleWriteConfig{
	Dir: expectedBundleDir,
	Policy: resolved.Effective,
	Tool: target.Tool,
	})

	hostsByService := map[string][]string{}
	if doc.Network != nil {
	for host, id := range doc.Network.ServiceDomains {
	hostsByService[id] = append(hostsByService[id], host)
	}
	for id, auth := range doc.Network.ServiceAuth {
	hostsByService[id] = append(hostsByService[id], auth.Hosts...)
	}
	for id := range hostsByService {
	hostsByService[id] = sortDedupeStrings(hostsByService[id])

Uh oh!

Conversation

sgraband commented Jul 31, 2026

What it does

How to test

Follow-ups

Breaking changes

Review checklist

Uh oh!

sdirix commented Aug 3, 2026

Uh oh!

EclipseSourceAI left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants