fix(config): mask wandb_api_key in config set output#66
Merged
Conversation
`config set wandb_api_key <value>` echoed the full secret to stdout, leaking it into terminal scrollback, CI logs, and tool transcripts whenever the install/migration flow ran. `config show` and `status` already masked to first-4-chars + ellipsis; only `set` was missed when `wandb_api_key` was added as a writable key. Extracted a single `maskSecret` helper used by all three call sites so the mask format lives in one place. `config get wandb_api_key` is intentionally left un-masked — it's the programmatic retrieval path (eg. the migration in the weave-install skill). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
HiveMind Sessions1 session · 13m · $5.94
View all sessions in HiveMind → Run |
Four tests of the same `config set` call (three on wandb_api_key, one on weave_project) collapse into one walking both branches of the mask-or-not decision: one CLI spawn for the secret path, one for the plain path. Also drops the maskSecret docstring (name is self-evident) and the test file's seven-line header in favor of a two-line "what + why". 9/9 passing (was 12/12 — the four merged into one and the suite wrapper went away). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
drtangible
reviewed
May 29, 2026
Addresses review feedback on #66 — two remaining `value.slice(0, 4)}…` sites in cmdInstall (env-var notice and post-prompt echo) now go through the same helper as config show/set and status. Audited the rest of the codebase: no other call sites log secrets. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Contributor
Author
thank you! Merging in |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
weave-claude-code config set wandb_api_key <value>echoed the full secret to stdout, leaking it into terminal scrollback, CI logs, and tool transcripts (including this PR's discovery transcript).config showandstatusalready masked the same value tofirst-4-chars + …; onlysetwas missed whenwandb_api_keywas added as a writable key in chore: add SPDX headers to build/release scripts #61 / commit 9250dd2.maskSecrethelper and routedconfig show,config set, andstatusthrough it so the mask format lives in one place.config get wandb_api_keyis intentionally left un-masked — it's the programmatic retrieval path (theweave-installskill's migration usesKEY=$(weave-claude-code config get wandb_api_key)).cmdInstall's interactive prompt already masks correctly (value.slice(0, 4)…) and is unchanged here — folding it intomaskSecretwould be a non-essential, currently-untested refactor.Test plan
tests/config-set-masks-secrets.test.tsexercises four behaviors:config set wandb_api_key: stdout does NOT contain the full secretconfig set wandb_api_key: stdout DOES contain thewand…masked prefixconfig set wandb_api_key: full secret IS persisted tosettings.json(display-only fix — guards against accidentally masking the on-disk value)config set weave_project: non-sensitive value is still echoed in full (guards against over-masking)stdout leaked the full secret: ✓ Set wandb_api_key = <full secret>, then passed after the fix.npm test).tscno errors.🤖 Generated with Claude Code