feat: secret-in-args warning badge (#1r) #16

2026-07-02T11:59:32-04:00

the_og commented

2026-07-02 11:59:32 -04:00

Summary

Adds args_secret_warning(data: dict) -> str | None to bcc_core.py — detects secret-shaped values in args via three paths: bare token-prefix values (e.g. ghp_…), values following a secret-named flag (--token abc), and URLs with embedded user:pass credentials (postgres://user:pass@host/db).
--flag=value inline pairs are intentionally skipped (the flag name already labels the value).
Adds self.secret_warn QLabel to ServerEditor's stdio page; shown/hidden by _check_args() on every field change, hidden on deselect and on stdio→remote type switch. Non-blocking — the save path is not touched.
8 new unit tests in section 10 of test_core.py covering all detection paths and key negatives (benign URLs, env-only secrets, inline flag pairs).

Test plan

python -m pytest — 92 passed
ruff check . — clean
ruff format --check . — clean
GUI smoke-test: core logic is unit-tested; bcc.py wiring done but not smoke-tested in a display environment (per HANDOFF note — no display available in this session)

Closes #1

## Summary - Adds `args_secret_warning(data: dict) -> str | None` to `bcc_core.py` — detects secret-shaped values in `args` via three paths: bare token-prefix values (e.g. `ghp_…`), values following a secret-named flag (`--token abc`), and URLs with embedded `user:pass` credentials (`postgres://user:pass@host/db`). - `--flag=value` inline pairs are intentionally skipped (the flag name already labels the value). - Adds `self.secret_warn` QLabel to `ServerEditor`'s stdio page; shown/hidden by `_check_args()` on every field change, hidden on deselect and on stdio→remote type switch. Non-blocking — the save path is not touched. - 8 new unit tests in section 10 of `test_core.py` covering all detection paths and key negatives (benign URLs, env-only secrets, inline flag pairs). ## Test plan - [x] `python -m pytest` — 92 passed - [x] `ruff check .` — clean - [x] `ruff format --check .` — clean - [ ] GUI smoke-test: core logic is unit-tested; `bcc.py` wiring done but not smoke-tested in a display environment (per HANDOFF note — no display available in this session) Closes #1

the_og added 1 commit 2026-07-02 11:59:32 -04:00

feat: warn when a secret-shaped value is found in args instead of env (#1r)

CI / Lint (ruff) (pull_request) Successful in 8s

Details

CI / Tests (py3.10) (pull_request) Successful in 10s

Details

CI / Tests (py3.12) (pull_request) Successful in 9s

Details

f4648b3c06

Adds `args_secret_warning(data)` to bcc_core — returns a warning string
when any arg positional value looks like a raw credential (token prefix,
value following a secret-named flag, or URL with embedded user:pass like
postgres://user:pass@host).  `--flag=value` inline forms are intentionally
skipped (the flag name already labels the value).

Adds `secret_warn` QLabel in ServerEditor's stdio page; shown/hidden by
`_check_args()` on every field change, and cleared on deselect or
stdio→remote type switch.  Non-blocking — save path is not touched.

Closes #1

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

the_og merged commit ece049c993 into main

2026-07-02 12:00:16 -04:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: the_og/better-claude-config#16