Repository navigation
Reject retired credentials in CLI transports - #397
John-David Dalton (jdalton) wants to merge 1 commit into
Conversation
31ea670 to
db4007e
Compare
Refuse the retired credential before the CLI starts HTTP or reachability work. Increment the package version required by the published-release check. Assisted-by: Codex:gpt-6.1-sol
db4007e to
cfada31
Compare
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.
Bugbot Autofix is ON, but none of the reported issues met your autofix severity threshold.
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit cfada31. Configure here.
| args.api_token | ||
| ) | ||
| api_token = select_api_token(os.environ, args.api_token) | ||
| reject_retired_api_token(api_token) |
There was a problem hiding this comment.
Retired-token error escapes CLI handler
Medium Severity
reject_retired_api_token raises ValueError from CliConfig.from_args. cli catches that and calls from_args again to read --disable-blocking and --exit-code-on-api-error. The second call raises the same error, so _emit_infrastructure_error never runs and those flags are ignored. Operators get an uncaught traceback instead of the CLI's formatted infrastructure error path.
Reviewed by Cursor Bugbot for commit cfada31. Configure here.
The CLI rejects a retired shared API credential before sending requests or starting reachability checks, and tells users to configure a replacement.
The check covers config parsing, HTTP client construction, and subprocess credentials. Existing environment and argument precedence is unchanged.
Validation: 10 focused tests and scoped Ruff checks pass.
Reject a retired shared API credential before API requests or reachability execution.