Conversation
…edaction ### Description This PR implements comprehensive security hardening for the CLI shell, credential management, and error handling flows. It prevents sensitive keys from leaking into command history, command-line arguments, or application error logs. ### Key Changes * **Shell History Privacy (`shell.ts`):** - Added strict regex patterns (`SENSITIVE_HISTORY_PATTERNS`) to filter out sensitive commands (e.g., private-key configurations) from being persisted to disk. - Enforced restrictive file permissions (`0o600`) on history storage. * **Credential Management (`auth.ts`):** - Blocked passing private keys directly as command-line arguments to `nado auth set`, directing users to interactive or environment-variable workflows. - Hardened the 1-Click Trading setup wizard and link-signer operations. * **Error Redaction (`errors.ts`, `index.ts`):** - Introduced automatic secret redaction (`redactSecrets`) across all error handling pathways, scrubbing 32-byte hex strings (`0x` + 64 hex characters) from terminal error messages. - Ensured uncaught exceptions caught by the CLI root entrypoint pass through the redaction layer before printing to `stderr`. ### Validation & Testing * **Invariants:** Verified shell filtering, file permissions, and error redaction rules match workspace security requirements.
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This PR implements comprehensive security hardening for the CLI shell, credential management, and error handling flows. It prevents sensitive keys from leaking into command history, command-line arguments, or application error logs.
Key Changes
shell.ts):SENSITIVE_HISTORY_PATTERNS) to filter out sensitive commands (e.g., private-key configurations) from being persisted to disk.0o600) on history storage.auth.ts):nado auth set, directing users to interactive or environment-variable workflows.errors.ts,index.ts):redactSecrets) across all error handling pathways, scrubbing 32-byte hex strings (0x+ 64 hex characters) from terminal error messages.stderr.Validation & Testing