security: redact complete delimiter-bearing secret values by codeforester · Pull Request #227 · basefoundry/base-cli

codeforester · 2026-08-26T05:31:47Z

Closes #220

Summary

treat commas, semicolons, and ampersands as part of secret values unless they begin a new assignment
apply the shared boundary behavior to argv, history, and JSON text redaction
add adversarial regressions for delimiter-bearing and adjacent assignments

UV_CACHE_DIR=/private/tmp/base-cli-uv-cache uv run --extra dev --extra typer pytest -q
UV_CACHE_DIR=/private/tmp/base-cli-uv-cache uv run --extra quality ruff check
UV_CACHE_DIR=/private/tmp/base-cli-uv-cache uv run --extra quality ruff format --check
UV_CACHE_DIR=/private/tmp/base-cli-uv-cache uv run --extra quality mypy --no-incremental --strict lib/python/base_cli

codeforester added 2 commits August 26, 2026 10:58

docs: define base-cli issue train design and plan

5b29886

security: redact complete delimiter-bearing secret values

91497df

codeforester merged commit ad7fdde into main Aug 26, 2026
110 of 111 checks passed

codeforester deleted the security/220-20260826-security-redact-complete-delimiter-bearing-secret-values branch August 26, 2026 05:36