the_og/better-claude-config
1
0
Fork 0
Code Issues 8 Pull Requests 3 Actions Packages Projects Releases 4 Wiki Activity

[#1r] Secret-in-args warning badge #1

New Issue
Closed
opened 2026-07-02 00:48:54 -04:00 by the_og · 1 comment
the_og commented 2026-07-02 00:48:54 -04:00
Owner
Copy Link
Copy Source

Problem

commit 6dee318 implemented env/header value masking, Show-secrets toggle, Add-dialog password echo, and redact_args in diagnostics. The one remaining piece: a non-blocking warning badge when a value that looks like a raw secret is sitting in args instead of env.

This matters because some servers (e.g. Postgres MCP) do not support env vars and force credentials into args, where they are visible in process listings and more likely to be pasted into bug reports or chats.

Proposed fix

  • In bcc_core.py, add a function (e.g. args_secret_warning(data: dict) -> str | None) that inspects data["args"] using the already-existing is_secret_key / _is_secret_value / redact_args heuristics and returns a warning string when a secret-shaped value is found positionally (not via a --key=val pair, where it is already partially self-documenting).
  • In bcc.py ServerEditor, call this function on every field change (alongside check_dependency) and display the result as a non-blocking badge/warning label near the Args field — similar style to the existing dependency-status badge.

Acceptance criteria

  • A server with args: ["--connection", "postgres://user:pass@host/db"] shows a visible non-blocking warning in the editor.
  • A server with env: {"DATABASE_URL": "postgres://..."} does not trigger the warning.
  • The warning does not block saving.
  • New unit tests in tests/test_core.py cover the detection function.

Relevant code

  • bcc_core.py lines 598–674: is_secret_key, _is_secret_value, redact_args, _TOKEN_PREFIXES
  • bcc.py ServerEditor class, _refresh_dep_status method
## Problem `commit 6dee318` implemented env/header value masking, Show-secrets toggle, Add-dialog password echo, and `redact_args` in diagnostics. The one remaining piece: a **non-blocking warning badge** when a value that looks like a raw secret is sitting in `args` instead of `env`. This matters because some servers (e.g. Postgres MCP) do not support env vars and force credentials into `args`, where they are visible in process listings and more likely to be pasted into bug reports or chats. ## Proposed fix - In `bcc_core.py`, add a function (e.g. `args_secret_warning(data: dict) -> str | None`) that inspects `data["args"]` using the already-existing `is_secret_key` / `_is_secret_value` / `redact_args` heuristics and returns a warning string when a secret-shaped value is found positionally (not via a `--key=val` pair, where it is already partially self-documenting). - In `bcc.py` `ServerEditor`, call this function on every field change (alongside `check_dependency`) and display the result as a non-blocking badge/warning label near the Args field — similar style to the existing dependency-status badge. ## Acceptance criteria - A server with `args: ["--connection", "postgres://user:pass@host/db"]` shows a visible non-blocking warning in the editor. - A server with `env: {"DATABASE_URL": "postgres://..."}` does **not** trigger the warning. - The warning does not block saving. - New unit tests in `tests/test_core.py` cover the detection function. ## Relevant code - `bcc_core.py` lines 598–674: `is_secret_key`, `_is_secret_value`, `redact_args`, `_TOKEN_PREFIXES` - `bcc.py` `ServerEditor` class, `_refresh_dep_status` method
the_og added the P0 label 2026-07-02 00:48:54 -04:00
the_og commented 2026-07-02 16:28:23 -04:00
Author
Owner
Copy Link
Copy Source

Supervisor scoping note before this gets picked up:

  • The line numbers in this issue are stale. They were written against an earlier revision (the body cites the masking funcs at ~598–674; in current main, MASK is ~L735). Grep for the function names, not the line numbers — anchors: is_secret_key, _is_secret_value, redact_args, _TOKEN_PREFIXES, MASK.
  • One source of truth. args_secret_warning() must reuse the existing detection heuristics — do not fork a second copy. This is the same discipline that kept masking consistent across the restore diff (#3) and stale-file diff (#4); keep it here.
  • Warn only on positional secrets. A bare token matched by _is_secret_value, or a postgres://user:pass@host/db style URL with inline creds. Do not warn on --key=value pairs (already self-documenting, handled by redact_args).
  • Suggested sequencing: do #12 (spawn-test timeout bump — two-line change) first as a quick warmup, then this one.

Full scoping is in HANDOFF-next-COWORK.md.

Supervisor scoping note before this gets picked up: - **The line numbers in this issue are stale.** They were written against an earlier revision (the body cites the masking funcs at ~598–674; in current `main`, `MASK` is ~L735). **Grep for the function names, not the line numbers** — anchors: `is_secret_key`, `_is_secret_value`, `redact_args`, `_TOKEN_PREFIXES`, `MASK`. - **One source of truth.** `args_secret_warning()` must reuse the existing detection heuristics — do not fork a second copy. This is the same discipline that kept masking consistent across the restore diff (#3) and stale-file diff (#4); keep it here. - **Warn only on positional secrets.** A bare token matched by `_is_secret_value`, or a `postgres://user:pass@host/db` style URL with inline creds. Do **not** warn on `--key=value` pairs (already self-documenting, handled by `redact_args`). - **Suggested sequencing:** do #12 (spawn-test timeout bump — two-line change) first as a quick warmup, then this one. Full scoping is in `HANDOFF-next-COWORK.md`.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
P0
P1
P2
blocked
Waiting on an external thing before it can move.
 decision
A decision record (D-007 style) — settled call, referenceable by number from any repo.
 needs-decision
Waiting on AJ's call.
 next
Current focus / next actionable item.
 status
The single pinned STATUS issue for this repo — live state, next action, open items, decisions needed.
No Label P0
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
the_og
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: the_og/better-claude-config#1
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?