Repository navigation
Reject retired credentials in CLI transports - #397
John-David Dalton (jdalton) wants to merge 1 commit into
Conversation
31ea670 to
db4007e
Compare
Refuse the retired credential before the CLI starts HTTP or reachability work. Increment the package version required by the published-release check. Assisted-by: Codex:gpt-6.1-sol
db4007e to
cfada31
Compare
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.
Bugbot Autofix is ON, but none of the reported issues met your autofix severity threshold.
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit cfada31. Configure here.
| args.api_token | ||
| ) | ||
| api_token = select_api_token(os.environ, args.api_token) | ||
| reject_retired_api_token(api_token) |
There was a problem hiding this comment.
Retired-token error escapes CLI handler
Medium Severity
reject_retired_api_token raises ValueError from CliConfig.from_args. cli catches that and calls from_args again to read --disable-blocking and --exit-code-on-api-error. The second call raises the same error, so _emit_infrastructure_error never runs and those flags are ignored. Operators get an uncaught traceback instead of the CLI's formatted infrastructure error path.
Reviewed by Cursor Bugbot for commit cfada31. Configure here.
Stop the Python CLI from sending the retired shared credential through API requests or reachability checks. The error tells users to configure a replacement.
Implementation and validation
Checks configuration selection, direct HTTP-client construction, and subprocess reachability credentials before use. A fingerprint check avoids storing credential values in source or errors. Environment and argument precedence stay unchanged; the SDK guard alone cannot cover these CLI paths.
Validation: ten focused tests passed, including real constructors and configuration parsing. New helper and test files passed Ruff. Tests use synthetic credentials without API requests.
Links and PR checklist
Reject a retired shared API credential before API requests or reachability execution.
Automated review notes