🤖 fix: redact MCP command env values and credential URLs in settings backup export

src/browser/features/Settings/Sections/BackupSection.tsx

@@ -359,15 +359,23 @@ export function BackupSection() {
     setStatusMessage(null);
     setPreview(null);
     setOverrideSecretScan(false);
+    // Cleared before the await, so a rejection (transport failure, not a scan result)
+    // cannot leave a previous scan's override rendering beside an unrelated error.
+    setSecretScanBlocked(false);
+    setSecretScanApproval(null);
 
     try {
       const result = await api.backup.preview(savedDraft);
       if (!result.success) {
         setActionError(getOperationErrorMessage(result.error));
+        // The scan state must describe this failure, not a previous push's: a stale
+        // digest would keep rendering an override the backend now rejects.
+        const blocked = result.error.code === "SECRET_DETECTED";
+        setSecretScanBlocked(blocked);
+        setSecretScanApproval(blocked ? (result.error.secretApproval ?? null) : null);
         return;
       }
       setPreview(result.data);
-      setSecretScanBlocked(false);
       const nextApprovals = result.data.commandApprovals;
       // An approval only covers the exact command text the user read, so a changed list
       // has to be read again.
@@ -600,10 +608,10 @@ export function BackupSection() {
           ))}
         </ul>
         <p className="text-foreground text-xs font-medium">
-          Provider key files and dedicated secret files have no export path. MCP commands and URLs
-          are included verbatim; credential-like URL components require review, while literal MCP
-          header values are redacted. Inside skills and memory, only documentation is published
-          automatically; any other file waits for you to review it.
+          Provider key files and dedicated secret files have no export path. Env-style values in MCP
+          commands, URLs carrying credentials, and literal MCP header values are redacted;
+          publishing a command still requires review. Inside skills and memory, only documentation
+          is published automatically; any other file waits for you to review it.
         </p>
       </section>
 
@@ -713,7 +721,9 @@ export function BackupSection() {
         )}
       </section>
 
-      {secretScanBlocked ? (
+      {/* A credential-format block carries no approval digest and cannot be overridden,
+          so a dead override control must not suggest otherwise. */}
+      {secretScanBlocked && secretScanApproval !== null ? (
         <div className="border-border-light rounded-md border p-3">
           <label className="flex items-start gap-2">
             <Checkbox

src/common/config/schemas/appConfigOnDisk.test.ts

@@ -142,13 +142,17 @@ describe("AppConfigOnDiskSchema", () => {
       "ssh+git:user:hunter2@",
       "https://example.com/repo.git?access_token=hunter2",
       "https://example.com/repo.git?passphrase=hunter2",
+      "https://example.com/repo.git?Ocp-Apim-Subscription-Key=hunter2",
       "https://example.com/repo.git#access_token=hunter2",
     ]) {
       expect(SettingsBackupSchema.safeParse({ ...base, repoUrl }).success).toBe(false);
     }
     for (const repoUrl of [
       "https://github.com/me/dotfiles.git",
       "https://github.com/me/dotfiles.git?client_id=mux",
+      // A descriptive option that happens to end in a credential word is not a
+      // provider-qualified signed-URL parameter.
+      "https://github.com/me/dotfiles.git?verify_signature=false",
       "https://github.com/me/dotfiles.git?code=review&key=branch&session=docs",
       "https://github.com/me/dotfiles.git#section=backup",
       "ssh://git@example.com/repo.git",

src/common/config/schemas/settingsBackup.ts

@@ -79,9 +79,14 @@ export const CREDENTIAL_URL_PARAMETER_NAMES: ReadonlySet<string> = new Set([
   "accesskeyid",
   "accesstoken",
   "apikey",
+  "apisecret",
+  "apitoken",
+  "appkey",
   "appsecret",
+  "apptoken",
   "auth",
   "authcode",
+  "authkey",
   "authorization",
   "authtoken",
   "awsaccesskeyid",
@@ -90,6 +95,7 @@ export const CREDENTIAL_URL_PARAMETER_NAMES: ReadonlySet<string> = new Set([
   "bearertoken",
   "clientkey",
   "clientsecret",
+  "clienttoken",
   "consumersecret",
   "credential",
   "credentials",
@@ -100,25 +106,46 @@ export const CREDENTIAL_URL_PARAMETER_NAMES: ReadonlySet<string> = new Set([
   "passwd",
   "password",
   "privatekey",
+  "privatetoken",
   "pwd",
   "refreshtoken",
   "secret",
   "secretaccesskey",
   "secretkey",
+  "secrettoken",
+  "securitytoken",
   "sessionid",
+  "sessiontoken",
+  "subscriptionkey",
+  "ocpapimsubscriptionkey",
   "signature",
   "token",
   "xamzcredential",
   "xamzsignature",
 ]);
 
+/**
+ * Signed-URL families qualify the credential word with a header-style provider
+ * prefix (`X-Goog-Signature`, `X-Amz-Credential`, `x-oss-security-token`), so an
+ * `x`-led name ending in one of these unambiguous words matches without enumerating
+ * providers. Descriptive options that merely end in the word
+ * (`verify_signature=false`) carry no provider marker and stay accepted.
+ */
+const PROVIDER_CREDENTIAL_NAME =
+  /^x[a-z0-9]*(?:accesskeyid|credential|secretaccesskey|securitytoken|signature)$/;
+
 function parametersContainCredential(
   parameters: URLSearchParams,
   names: ReadonlySet<string>
 ): boolean {
   for (const [name, value] of parameters) {
     const normalizedName = name.toLowerCase().replace(/[^a-z0-9]/g, "");
-    if (value !== "" && names.has(normalizedName)) return true;
+    if (value === "") continue;
+    if (names.has(normalizedName)) return true;
+    // Header-style spellings prefix the same names with `x` (`x-api-key`,
+    // `X-Auth-Token`), so one stripped leading `x` matches the whole class.
+    if (normalizedName.startsWith("x") && names.has(normalizedName.slice(1))) return true;
+    if (PROVIDER_CREDENTIAL_NAME.test(normalizedName)) return true;
   }
   return false;
 }

src/node/services/backup/backupService.integration.test.ts

@@ -156,7 +156,7 @@ describe("BackupService against a real repository", () => {
     );
   });
 
-  it("blocks a push when a backed-up file contains a token, and proceeds once allowed", async () => {
+  it("blocks a push outright when a backed-up file contains a credential token", async () => {
     await writeFixtureFile(
       muxRoot,
       "AGENTS.md",
@@ -165,34 +165,31 @@ describe("BackupService against a real repository", () => {
 
     const blocked = await service.push(settings);
     expect(blocked.success).toBe(false);
-    if (blocked.success) throw new Error("Expected the secret scan to block the push");
+    if (blocked.success) throw new Error("Expected the credential backstop to block the push");
     expect(blocked.error.code).toBe("SECRET_DETECTED");
     expect(blocked.error.files).toContain("AGENTS.md");
+    // No approval digest: a credential-format match has no user override.
+    expect(blocked.error.secretApproval ?? null).toBeNull();
     expect(await runGit(["--git-dir", originPath, "rev-list", "--count", "--all"])).toBe("0");
 
-    const allowed = await service.push(settings, {
-      approvedSecretDigest: blocked.error.secretApproval ?? undefined,
-    });
-    expect(allowed.success).toBe(true);
+    const stillBlocked = await service.push(settings, { approvedSecretDigest: "any-digest" });
+    expect(stillBlocked.success).toBe(false);
+    expect(await runGit(["--git-dir", originPath, "rev-list", "--count", "--all"])).toBe("0");
   });
 
-  it("gates a low-entropy MCP URL credential until the exact payload is approved", async () => {
+  it("redacts a low-entropy MCP URL credential instead of gating the push", async () => {
     const url = "https://user:hunter2@example.com/mcp?api_key=abc123";
     await writeFixtureFile(muxRoot, "mcp.jsonc", JSON.stringify({ servers: { private: { url } } }));
 
-    const blocked = await service.push(settings);
-    expect(blocked.success).toBe(false);
-    if (blocked.success) throw new Error("Expected the URL credential gate to block the push");
-    expect(blocked.error.code).toBe("SECRET_DETECTED");
-    expect(blocked.error.files).toEqual(["mcp.jsonc"]);
-    expect(await runGit(["--git-dir", originPath, "rev-list", "--count", "--all"])).toBe("0");
+    const pushed = await service.push(settings);
+    expect(pushed.success).toBe(true);
+    if (!pushed.success) throw new Error("Expected the redacted payload to push cleanly");
+    expect(pushed.data.redactions).toEqual(["servers.private.url"]);
 
-    const allowed = await service.push(settings, {
-      approvedSecretDigest: blocked.error.secretApproval ?? undefined,
-    });
-    expect(allowed.success).toBe(true);
     const clone = await cloneOrigin("url-credential-verify");
-    expect(await fs.readFile(path.join(clone, "mux/mcp.jsonc"), "utf-8")).toContain(url);
+    const published = await fs.readFile(path.join(clone, "mux/mcp.jsonc"), "utf-8");
+    expect(published).not.toContain("hunter2");
+    expect(published).toContain(REDACTED_BACKUP_VALUE);
   });
 
   it("requires exact-payload approval before publishing an MCP command", async () => {