commit 6dee318 implemented env/header value masking, Show-secrets toggle, Add-dialog password echo, and redact_args in diagnostics. The one remaining piece: a non-blocking warning badge when a value that looks like a raw secret is sitting in args instead of env.
This matters because some servers (e.g. Postgres MCP) do not support env vars and force credentials into args, where they are visible in process listings and more likely to be pasted into bug reports or chats.
Proposed fix
In bcc_core.py, add a function (e.g. args_secret_warning(data: dict) -> str | None) that inspects data["args"] using the already-existing is_secret_key / _is_secret_value / redact_args heuristics and returns a warning string when a secret-shaped value is found positionally (not via a --key=val pair, where it is already partially self-documenting).
In bcc.pyServerEditor, call this function on every field change (alongside check_dependency) and display the result as a non-blocking badge/warning label near the Args field — similar style to the existing dependency-status badge.
Acceptance criteria
A server with args: ["--connection", "postgres://user:pass@host/db"] shows a visible non-blocking warning in the editor.
A server with env: {"DATABASE_URL": "postgres://..."} does not trigger the warning.
The warning does not block saving.
New unit tests in tests/test_core.py cover the detection function.
## Problem
`commit 6dee318` implemented env/header value masking, Show-secrets toggle, Add-dialog password echo, and `redact_args` in diagnostics. The one remaining piece: a **non-blocking warning badge** when a value that looks like a raw secret is sitting in `args` instead of `env`.
This matters because some servers (e.g. Postgres MCP) do not support env vars and force credentials into `args`, where they are visible in process listings and more likely to be pasted into bug reports or chats.
## Proposed fix
- In `bcc_core.py`, add a function (e.g. `args_secret_warning(data: dict) -> str | None`) that inspects `data["args"]` using the already-existing `is_secret_key` / `_is_secret_value` / `redact_args` heuristics and returns a warning string when a secret-shaped value is found positionally (not via a `--key=val` pair, where it is already partially self-documenting).
- In `bcc.py` `ServerEditor`, call this function on every field change (alongside `check_dependency`) and display the result as a non-blocking badge/warning label near the Args field — similar style to the existing dependency-status badge.
## Acceptance criteria
- A server with `args: ["--connection", "postgres://user:pass@host/db"]` shows a visible non-blocking warning in the editor.
- A server with `env: {"DATABASE_URL": "postgres://..."}` does **not** trigger the warning.
- The warning does not block saving.
- New unit tests in `tests/test_core.py` cover the detection function.
## Relevant code
- `bcc_core.py` lines 598–674: `is_secret_key`, `_is_secret_value`, `redact_args`, `_TOKEN_PREFIXES`
- `bcc.py` `ServerEditor` class, `_refresh_dep_status` method
the_og
added the P0 label 2026-07-02 00:48:54 -04:00
Supervisor scoping note before this gets picked up:
The line numbers in this issue are stale. They were written against an earlier revision (the body cites the masking funcs at ~598–674; in current main, MASK is ~L735). Grep for the function names, not the line numbers — anchors: is_secret_key, _is_secret_value, redact_args, _TOKEN_PREFIXES, MASK.
One source of truth.args_secret_warning() must reuse the existing detection heuristics — do not fork a second copy. This is the same discipline that kept masking consistent across the restore diff (#3) and stale-file diff (#4); keep it here.
Warn only on positional secrets. A bare token matched by _is_secret_value, or a postgres://user:pass@host/db style URL with inline creds. Do not warn on --key=value pairs (already self-documenting, handled by redact_args).
Suggested sequencing: do #12 (spawn-test timeout bump — two-line change) first as a quick warmup, then this one.
Full scoping is in HANDOFF-next-COWORK.md.
Supervisor scoping note before this gets picked up:
- **The line numbers in this issue are stale.** They were written against an earlier revision (the body cites the masking funcs at ~598–674; in current `main`, `MASK` is ~L735). **Grep for the function names, not the line numbers** — anchors: `is_secret_key`, `_is_secret_value`, `redact_args`, `_TOKEN_PREFIXES`, `MASK`.
- **One source of truth.** `args_secret_warning()` must reuse the existing detection heuristics — do not fork a second copy. This is the same discipline that kept masking consistent across the restore diff (#3) and stale-file diff (#4); keep it here.
- **Warn only on positional secrets.** A bare token matched by `_is_secret_value`, or a `postgres://user:pass@host/db` style URL with inline creds. Do **not** warn on `--key=value` pairs (already self-documenting, handled by `redact_args`).
- **Suggested sequencing:** do #12 (spawn-test timeout bump — two-line change) first as a quick warmup, then this one.
Full scoping is in `HANDOFF-next-COWORK.md`.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Problem
commit 6dee318implemented env/header value masking, Show-secrets toggle, Add-dialog password echo, andredact_argsin diagnostics. The one remaining piece: a non-blocking warning badge when a value that looks like a raw secret is sitting inargsinstead ofenv.This matters because some servers (e.g. Postgres MCP) do not support env vars and force credentials into
args, where they are visible in process listings and more likely to be pasted into bug reports or chats.Proposed fix
bcc_core.py, add a function (e.g.args_secret_warning(data: dict) -> str | None) that inspectsdata["args"]using the already-existingis_secret_key/_is_secret_value/redact_argsheuristics and returns a warning string when a secret-shaped value is found positionally (not via a--key=valpair, where it is already partially self-documenting).bcc.pyServerEditor, call this function on every field change (alongsidecheck_dependency) and display the result as a non-blocking badge/warning label near the Args field — similar style to the existing dependency-status badge.Acceptance criteria
args: ["--connection", "postgres://user:pass@host/db"]shows a visible non-blocking warning in the editor.env: {"DATABASE_URL": "postgres://..."}does not trigger the warning.tests/test_core.pycover the detection function.Relevant code
bcc_core.pylines 598–674:is_secret_key,_is_secret_value,redact_args,_TOKEN_PREFIXESbcc.pyServerEditorclass,_refresh_dep_statusmethodSupervisor scoping note before this gets picked up:
main,MASKis ~L735). Grep for the function names, not the line numbers — anchors:is_secret_key,_is_secret_value,redact_args,_TOKEN_PREFIXES,MASK.args_secret_warning()must reuse the existing detection heuristics — do not fork a second copy. This is the same discipline that kept masking consistent across the restore diff (#3) and stale-file diff (#4); keep it here._is_secret_value, or apostgres://user:pass@host/dbstyle URL with inline creds. Do not warn on--key=valuepairs (already self-documenting, handled byredact_args).Full scoping is in
HANDOFF-next-COWORK.md.