[jdx]

Summary

• add a global-only experimental Bearer token setting for remote task cache authentication
• attach the token to every remote request with a sensitive Authorization header
• retain explicit repository or organization namespace isolation from the preceding stack layer

Tests

• cargo test task_cache_store::tests
• cargo clippy --workspace --all-features --all-targets -- -D warnings
• mise run lint-fix

AI-assisted — Tool: Codex; model: unavailable/unavailable; version: unavailable.

---

Note

Medium Risk
Introduces credential handling and transport policy for remote cache traffic; mitigations include global-only config, HTTPS enforcement when a token is set, sensitive header marking, and redaction in diagnostics.

Overview
Adds Bearer token authentication for the experimental remote task cache via a new global-only task.cache_remote_token setting (MISE_TASK_CACHE_REMOTE_TOKEN), wired from settings into RemoteTaskCacheConfig and sent on every HTTP cache request as a sensitive Authorization header.

Transport rules are tightened: credentialed requests require HTTPS except on loopback; unauthenticated non-loopback HTTP is allowed only with an explicit transit-risk warning. The remote cache protocol doc and JSON schema/settings docs are updated accordingly, and the parity tracker marks authentication/namespaces as done.

Credential hygiene: remote cache tokens are redacted in debug settings dumps and in as_dict / partial settings tables so they do not leak in logs or exported config.

^{Reviewed by Cursor Bugbot for commit de646ab. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 75bc208d-e42a-476b-a402-5df941b1033e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Greptile Summary

The PR adds global-only Bearer authentication for remote task-cache requests while redacting the credential from settings diagnostics and output.

• Passes the configured token into the HTTP cache store and marks the authorization header sensitive.
• Requires HTTPS for authenticated non-loopback endpoints while retaining warned, unauthenticated HTTP compatibility.
• Documents the authentication and transport behavior and updates the generated settings schema.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains; the previously reported credential disclosure and unauthenticated HTTP compatibility issues are fixed in the current code.

Important Files Changed

Filename	Overview
src/task/task_cache_store.rs	Adds sensitive Bearer headers and transport validation; the previously reported authenticated and unauthenticated HTTP cases are addressed.
src/config/settings.rs	Redacts the remote-cache token from trace diagnostics and settings dictionary output used by settings commands.
settings.toml	Defines the token as an environment-backed, global-only setting so project configuration cannot supply it.
src/task/task_cache.rs	Threads the configured token into remote cache construction without changing cache key or artifact behavior.
docs/tasks/remote-cache-protocol.md	Documents authenticated HTTPS requirements and warned unauthenticated HTTP compatibility.

_{Reviews (12): Last reviewed commit: "fix(config): redact remote cache token f..." | Re-trigger Greptile}

[github-actions]

Instruction counts

benchmark	trend	instructions	Δ	wall (min)	Δ
env	▂▃▁▁▁▁▃▂▂█	80,074,952 → 80,295,451	+0.28%	17.64 → 18.31ms	+3.80%
hook-env	▄▄▁▃▂▂▃▂▃█	82,190,914 → 82,415,481	+0.27%	18.34 → 19.19ms	+4.63%
ls	▃▃▁▁▁▄▄▄▄█	73,127,800 → 73,310,960	+0.25%	15.71 → 16.24ms	+3.33%
registry	▁▁▂▂▃▆▆█▂▇	49,102,713 → 49,179,957	+0.16%	11.64 → 12.65ms	+8.63%
startup	▂▂▁▂▂▁▁▂▂█	15,784,751 → 15,860,323	+0.48%	9.04 → 9.39ms	+3.91%

No instruction-count regression above 1%.

_{Only instruction counts gate. Wall clock is shown for context — on identical hardware it moves 4-20% run to run.}

_{Measured by tak — instruction-counted CLI benchmarks, stored in this repository's git notes.}

_{de646abf94a1 vs e5230aa14775 · measured on the runner, not pushed to the history.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit bc0f377. Configure here.}