feat(git-sync): sync extra_perms for variables (#11004)

* feat(git-sync): sync extra_perms for variables

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Hvv5B8VP5Di4dbcCiVyZyE

* refactor: trim the variable ACL-sync comment to the 4-line limit

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Hvv5B8VP5Di4dbcCiVyZyE

* test: cover the revoke direction of variable extra_perms sync

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Hvv5B8VP5Di4dbcCiVyZyE

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Ruben Fiszel
2026-09-07 15:57:09 +02:00
committed by GitHub
co-authored by Claude Opus 5
parent 670404ffe2
commit ee9e550a48
5 changed files with 197 additions and 34 deletions
+1 -1
View File
@@ -104,7 +104,7 @@ export async function downloadZip(
// from v1 the on-behalf-of address is stripped below, so the tarball sends the
// `has_on_behalf_of` marker instead and never resolves an address.
// `preserve_extra_perms=true` opts the tarball into surfacing granular ACLs
// on flow / script / app rows. Default-off on the server protects cross-
// on script / flow / app / variable rows. Default-off on the server protects cross-
// workspace tarball imports from carrying ACLs that reference identities
// missing in the target workspace; the CLI sync flow explicitly wants them.
const baseParams = `&plain_secret=${plainSecrets ?? false