Repository navigation
Keep keys off redirects to another host, and check base-URL variables, --user and cp paths - #27
Open
cory-salad wants to merge 4 commits into
Open
cory-salad wants to merge 4 commits into
cory-salad wants to merge 4 commits into
Conversation
…, --user and cp paths A redirect to another host no longer carries the API key or the AI Gateway key. The base-URL variables must be https unless they name localhost, and one that names another machine prints a warning. --user on ssh, sftp and cp must be a user name, an SSH endpoint that is not an address and a port is refused, and cp refuses a path with a control character. Co-Authored-By: Claude Mythos 5.2 <noreply@anthropic.com>
Credentials stay off a redirect chain once it has left the first host. Only localhost and loopback addresses count as this machine for a base-URL variable; login, ai-gateway login and doctor report a bad one before anything else, and the warning says what each variable carries. ssh --config quotes and checks the identity file path and reports a malformed endpoint, sftp takes an IPv6 address in brackets, and messages quote an instance ID that is not one. Co-Authored-By: Claude Mythos 5.2 <noreply@anthropic.com>
Co-Authored-By: Claude Mythos 5.2 <noreply@anthropic.com>
Also keep the nothing-was-saved hint on ai-gateway login for anything but a usage error, and reword the base-URL row of the validation table and the guide's line about the warning. Co-Authored-By: Claude Mythos 5.2 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Hardening for how the CLI handles its keys and the values it passes to ssh and sftp. Normal use is unchanged; the new
checks of what you type are usage errors (exit 2) with rows in the validation table.
Changes
SALAD_CLI_API_BASE_URL,SALAD_CLI_STORAGE_BASE_URLandSALAD_CLI_AI_GATEWAY_BASE_URLmust be https unless theyname localhost, and one that names another machine prints a
warning:on stderr.--useroncontainer-groups ssh,sftpandcpmust be a user name, and an SSH endpoint that is not an addressand a port is refused (exit 1).
container-groups cprefuses a path with a control character.container-groups ssh --configquotes an identity file path that holds a space, and refuses one it cannot write.Checklist
just cipasses (formatting, lint, and the offline tests)docs/(and the README, if install or getting started changed) andCHANGELOG.md(under Unreleased) reflect thechange:
docs/guide.md, the validation table inAGENTS.md, andCHANGELOG.md.not run. The transport change is covered by offline tests against local servers.
🤖 Generated with Claude Code